Root Evidence puts real-world evidence at the center of vulnerability prioritization

Root Evidence has launched the Evidence Platform, a vulnerability management platform that prioritizes vulnerabilities based on evidence of real-world exploitation and financial impact rather than severity scores alone.

The platform is designed to help security teams focus on the vulnerabilities most likely to contribute to ransomware, business disruption, and financial loss.

“The cybersecurity industry has become exceptionally good at finding vulnerabilities, but it has not become significantly better at preventing financial loss,” said Jeremiah Grossman, CEO of Root Evidence. “As a whole, we’ve optimized for finding problems instead of proving which ones actually matter. Security leaders require better evidence rather than another tool that will simply increase their workload.”

Recent research from Omdia found that growing numbers of threats and exposures are leaving many organizations unable to remediate everything, increasing demand for technologies that provide greater context for security decisions and risk reduction.

“Security teams have no shortage of vulnerability data; the challenge is determining which exposures are most likely to affect business outcomes,” said Theresa Lanowitz, principal analyst, vulnerability and risk management at Omdia. “Organizations are increasingly looking for approaches that combine technical evidence, operational context, and financial impact so they can make more informed risk decisions.”

Evidence over assumptions

Built on cyber insurance claims, actuarial analysis, digital forensics intelligence, attack surface intelligence, and real-world breach data, Root Evidence introduces an evidence-based operating model for cybersecurity that helps organizations reduce noise, prioritize remediation, and focus resources where they will have the greatest business impact.

“For years, the industry has forced security teams to make critical remediation decisions using theoretical severity scores and assumptions,” said Robert Hansen, CTO of Root Evidence. “We believe organizations should prioritize vulnerabilities using evidence: real-world financial loss, cyber insurance claims, digital forensics, and observed attacker behavior. That’s a fundamentally different way to think about cyber risk.”

The result is a simple new decision framework: Stop prioritizing vulnerabilities by severity and start prioritizing them by evidence of financial loss.

Confidence backed by Evidence

To reinforce confidence in its methodology, Root Evidence is also introducing the Mythos Warranty. Under the warranty, customers receive up to $5 million in financial loss protection for covered events resulting from a CVE Root Evidence did not identify and report. The warranty is backed by cyber insurance underwriting partners that independently evaluated Root Evidence’s methodology and agreed to underwrite the risk.

“The Mythos Warranty isn’t simply Root Evidence making a promise,” said Grossman. “Independent cyber insurance underwriters evaluated our methodology and agreed to stand behind it financially. This isn’t an indication of confidence in our evidence; it’s validation by the same industry that pays for cyber losses every day.”

The Evidence Platform combines continuous attack surface visibility, evidence-based vulnerability prioritization, executive reporting, and risk communication to help organizations make faster, more confident remediation decisions. The full platform includes:

• Evidence Surface: Discovers and monitors Internet-facing assets across an organization’s environment.
• Evidence Scan: Identifies Financial Risk Exposures (FIREs), vulnerabilities associated with verified financial losses.
• Evidence Reporting: Translates technical findings into financial risk metrics and board-ready reporting.
• Mythos Warranty: Provides up to $5 million in financial loss protection and aligns Root Evidence’s success with customer outcomes.

This launch also marks the beginning of a broader industry education initiative focused on challenging long-held assumptions about vulnerability management. Through original research, educational content, and its inaugural report, “Stop Counting CVEs: What Actually Mattered,” Root Evidence will examine why more vulnerability findings haven’t reduced breaches, what actually drives financial loss, and how organizations can make more effective remediation decisions using evidence instead of assumptions.

“We’re introducing a better way to make cybersecurity decisions,” said Grossman. “We believe the future of cybersecurity will be defined by who provides the best evidence for what to fix first. The next generation of cybersecurity products will measure risk using actuarial evidence, financial outcomes and real-world loss data. We believe that this is the direction that the industry is headed and we are building towards that future.”