What your child will learn
Locate a CVE entry on cve.mitre.org or NVD and identify the description, affected-versions list, CVSS base score, and references
Explain the CVSS vector string and apply it to prioritization
Apply the prioritization rule: internet-facing un-auth RCE with public exploit code outranks internal-only authenticated bug by raw CVSS
Distinguish "patch" / "mitigate" / "accept" / "transfer" — the four remediation patterns professional programs use
Reconstruct an attack chain — phishing → credential theft → privilege escalation → data exfil — and identify which link the CVE applies to
How this mission works
Now you triage. Read real CVE entries, map them to CVSS vectors, and apply the "fix-now-vs-fix-later" framework. CVSS is one input; the real prioritization weights combine internet-facing-ness, authentication requirement, exploit-availability, and in-the-wild signals. Map findings to remediation patterns: patch, mitigate, accept, transfer. Aligned to CSTA + AP CSP + AP Cybersecurity.
What students actually encounter
Which CVE entry field tells you whether exploitation requires user interaction (e.g. victim must click a link)?
You have two findings — an unauth-RCE on an internet-facing host (CVSS 9.8, public exploit code) and an authenticated SSRF on an internal tool (CVSS 7.5, no public exploit). Which do you fix first and why?
You map a finding to a CWE. What is a CWE?
Cipher is with them the whole way
When a student gets stuck on Pen-Test Vuln Analysis 301 — Reading CVEs & Prioritizing Risk, Cipher appears with a mission-specific nudge — no spoilers, just a hint toward the right thinking. Make a wrong choice, and Cipher explains the real-world consequence. Finish the mission, and Cipher generates a personalized performance debrief based on exactly how the student played it.
ISTE alignment
Triage dozens of findings by CVSS + EPSS + blast-radius, not by raw CVE count. Senior pentesters think in dollars and blast-radius, not raw CVE counts. The "14 critical findings, one of which could exfiltrate the customer database at $4M regulatory fine + $8M reputational cost" framing is the executive-summary level. Aligned to NICE-SU-PEN-02 ("apply formal methods of risk analysis").