Vulnerability Severity Alone Doesn't Determine Security Priorities in Critical Infrastructure

A high-severity vulnerability doesn't always present the greatest operational risk, particularly in infrastructure environments where remediation decisions can affect essential services. A severe flaw in an isolated development server may warrant less immediate attention than a lower-severity vulnerability affecting a vital operational system, especially when taking that system offline for remediation could disrupt service delivery.

Vilas Shewale, Principal Specialist at Energy Transfer, has nearly 30 years of experience across enterprise IT, including banking, technology, and energy environments. His work spans endpoint security, system hardening, and large-scale infrastructure deployments, giving him firsthand experience with the operational constraints that influence cybersecurity decisions.

"Standard vulnerability scores and real-world risk rarely match. That's one of the biggest misunderstandings in cybersecurity," Shewale says.

Cybersecurity risks extend beyond infrastructure operators

Cybersecurity incidents in the energy sector can have consequences far beyond the organizations directly affected, as disruptions to power grids, pipelines, and other essential infrastructure can interrupt services that communities and businesses rely on. The Colonial Pipeline incident demonstrated how a compromise affecting corporate IT systems could disrupt fuel distribution across multiple states. "People waited in long lines for fuel, and multiple states along the East Coast were affected," Shewale recalls. 

Maintaining the infrastructure that supports these services presents additional security challenges. Energy operators often manage environments where legacy operational technology (OT) and supervisory control and data acquisition (SCADA) systems coexist with newer equipment. "They still work beautifully, so organizations keep them running," Shewale says.

Replacing or upgrading these systems can be expensive, while their importance to daily operations may limit opportunities for maintenance. As a result, security teams must evaluate vulnerabilities in the context of the assets they affect, including how exposed those systems are and what would happen if they were compromised.

Technical severity doesn't tell the full risk story

While standardized vulnerability scores help identify technical weaknesses, they can't fully account for the environments in which those weaknesses exist. Shewale illustrates this distinction with a hypothetical vulnerability carrying a CVSS score of 9.8 and affecting two development servers isolated behind firewalls. "The vulnerability still exists. I'm not denying that, and we still need to address it. But the practical business risk may be very low, so the patch can wait," he explains.

A lower-scoring vulnerability in a production database could require a more urgent response. Shewale describes a flaw rated 4 or 5 that could, under certain conditions, allow an attacker to exploit SQL injection and expose sensitive information, including Social Security numbers and other personal data. "Even with a lower score, that vulnerability becomes a top priority," he says.

Energy infrastructure brings additional considerations, as the operational importance of a system can increase the consequences of exploitation while limiting remediation options. "A control system could have a medium-severity vulnerability, but you might be unable to shut it down for several months because you're in a critical operating season and have no maintenance window," Shewale says. "That operational constraint must be part of your decision-making."

Operational demands complicate vulnerability remediation

Maintenance windows in energy environments depend on operational demands, environmental conditions, and regulatory requirements. "You can't schedule maintenance without considering the weather and energy demand," Shewale says. "If a hurricane is coming, you don't want to take critical systems offline." Extreme heat and winter storms can impose similar restrictions, particularly when electricity and fuel infrastructure are already operating under significant pressure. 

Delaying maintenance, however, means security teams must continue managing vulnerabilities until remediation becomes possible. Shewale emphasizes the importance of monitoring affected systems, evaluating compensating controls, and documenting remediation decisions. "You need to document your reasoning and weigh not just the security score but also the importance and criticality of the system," he says.

Those decisions also require coordination with operational stakeholders, who must understand how security changes could affect ongoing services. Recommendations that work in conventional enterprise IT environments may be unsuitable for infrastructure where an unexpected interruption carries wider consequences. "A consultant coming from a traditional IT environment might recommend an immediate change. You sometimes have to slow down and assess the operational implications before following that recommendation," Shewale says.

Across large IT and OT environments, security teams face the added complexity of assessing vulnerabilities across thousands of assets. Each finding requires an understanding of the affected system and its operational importance, creating opportunities for AI to accelerate analysis and help teams identify the most pressing risks.

AI brings new possibilities to vulnerability management

AI can help security teams analyze vulnerabilities by correlating alerts, assessing asset importance, and identifying potential threats. "Work that might take a human team weeks can potentially be done by AI in minutes," Shewale says. However, “we shouldn't trust AI to make decisions that could shut down a pipeline, disrupt a power grid, block a critical system, or alter train routes without appropriate oversight," he cautions.

For Shewale, AI's immediate value lies in helping security teams identify and prioritize threats while leaving operational decisions to experienced professionals. Before granting these systems greater autonomy, he wants evidence that they can explain their decisions, handle unexpected conditions, and allow human intervention. Until then, human judgment remains central to balancing cybersecurity risks with operational continuity. "It's about making systems safer for the public, making smart trade-offs, and keeping the lights on for years to come," he concludes.