Flashpoint has been awarded U.S. Patent No. 12,705,360 for its Ransomware Risk model, a vulnerability scoring method that helps security teams identify newly disclosed flaws that resemble those exploited in ransomware attacks and prioritize patching accordingly.

Granted Aug. 11, 2026, the patent covers the methodology behind the Ransomware Risk score, which has been available through Flashpoint Vulnerability Intelligence (VI) since 2022.

Traditional vulnerability scoring frameworks, including the Common Vulnerability Scoring System (CVSS), measure the potential severity of a vulnerability but do not indicate whether attackers are likely to exploit it. According to Flashpoint, this distinction is particularly important as ransomware-as-a-service (RaaS) groups increasingly target technical conditions that enable fast and repeatable exploitation. The company observed a 45% increase in RaaS attacks during the first half of 2026.

Flashpoint's Ransomware Risk model provides security teams with a ransomware-specific risk signal when a vulnerability is disclosed, without requiring them to wait for exploitation reports to emerge weeks later.

"As vulnerability disclosures surge, prioritization is more important than ever for security teams," said Josh Lefkowitz, co-founder and CEO of Flashpoint. "A severity score alone can't tell you which vulnerabilities pose the greatest real-world risk of exploitation by ransomware actors. Our patented Ransomware Risk model applies years of threat intelligence to that problem, giving customers an earlier signal and helping them prioritize based on how attackers actually operate."

How the Ransomware Risk Model Works

The patented methodology evaluates vulnerabilities through four steps. First, multi-factor fingerprinting profiles each vulnerability against more than 60 technical factors, including whether it can be exploited remotely without authentication, whether it affects operational technology (OT) systems and how it could affect data availability.

Next, coordinate mapping converts each vulnerability's technical profile into a set of values that places it at a point on a map. Vulnerabilities with similar profiles appear close together. The model then uses historical threat data to identify clusters of vulnerabilities that have been exploited in real-world ransomware attacks.

Finally, the model assigns each new vulnerability a Low, Medium, High or Critical rating based on its proximity to those clusters.

The model updates as new ransomware activity is confirmed, allowing its ratings to reflect current attack patterns. It also covers every vulnerability tracked by Flashpoint VI, including more than 105,000 vulnerabilities that are not listed in the Common Vulnerabilities and Exposures (CVE) system or the National Vulnerability Database (NVD).

Within Flashpoint Ignite, the Ransomware Risk score appears alongside CVSS versions 3 and 4, the Exploit Prediction Scoring System (EPSS), Social Risk and exploit maturity. This combination allows security teams to identify lower-severity vulnerabilities that might otherwise receive less attention under CVSS but share characteristics with vulnerabilities targeted by ransomware actors.

The four-step methodology was developed by Flashpoint's Ben Haynes and Jacob Kouns and forms the basis of U.S. Patent No. 12,705,360.

“Despite being the most popular indicator for priority, we know that severity alone doesn’t tell you whether a vulnerability will be exploited or used in ransomware,” said Ben Haynes, data science and analytics lead at Flashpoint and co-inventor of the patented methodology. “A vulnerability can score low on a traditional severity scale and still share the characteristics we repeatedly see in ransomware attacks. This highlights the importance of having a multi-faceted prioritization strategy, or else organizations can get caught off guard by our complex and ever-changing threat landscape.”