Smart recommendations

One row per system, ranked with a score of 0–100. The score is not a black box: clicking it opens the score breakdown — for each term the measured value, its weight, the points it contributed and a sentence saying where the value came from. The points sum exactly to the score.

The five terms

Term	What is measured	Default weight
Update urgency	How far behind the system actually is, including failed updates	26%
External exposure	How many of its servers face outward — B2B / Tier 1 / Tier 2	26%
Business criticality	The worst business classification across the BIA records	24%
Open vulnerabilities	Vulnerabilities matched to the system's servers, weighted by CVSS	14%
Scope	Number of servers and system connections	10%

The weights are adjustable in settings, on the Suggestion weights screen. They are relative and need not add up to 100 — the screen shows the effective weight after normalization beside each term, and the shipped default beside that, so a change is visible and reversible.

Score	Level
70 and above	Urgent
45–69	High
25–44	Medium
Below 25	Low

Why a critical, fully patched system scores zero

Exposure, criticality and scope are static properties of a system: they never improve, however well it is patched. Counted as ordinary terms they would give a fully up-to-date system a score floor and land it in High for no reason — and a ranking in which every row is high is not a ranking.

So those three terms are multiplied by need: how much the system actually wants patching right now. Need is built from the other two terms — being behind on updates, and open vulnerabilities. If both are zero the score is zero, however important or exposed the system is.

What raises and lowers urgency

• A planned event already covering the system lowers urgency sharply. The risk has not changed, but the decision has been made, and a list that keeps shouting about booked work stops being read.
• Failed updates raise it. A system that will not take its updates is in a worse state than its due date describes.

By the same logic, a term with no input is dropped and the rest are re-normalized. If the vulnerability register could not be read, systems are not treated as vulnerability-free — the term simply does not take part.

The screen

The top bar switches between Servers, Databases and Equipment, filters servers to Windows or Linux, and carries two toggles: “Only what needs attention” against “Including up-to-date systems”, and “Security only” — only systems whose score has a contribution from open vulnerabilities.

Each row carries a System health ring splitting its servers four ways — Stale · Within 30 days · No date · OK — and expanding the row separates the servers into Windows and Linux, each side with its own quick-event button. That split is not decoration: the two operating systems run on separate update types and separate schedules, and one event cannot cover both.

What can be done from a row

Action	What happens	Permission
Excel export	A workbook for the system: the score's arithmetic on one sheet, then a sheet per operating-system half	suggestions.export
Send to the system manager	Opens a new mail window in Outlook with the file attached, to review and send. The product does not send it	suggestions.send_mail
Quick event	Opens the scheduling wizard with that half's servers, up to fifty; when there are more, the screen says the event will hold the most urgent ones and marks which servers were left out	Administrator

The business criticality feeding the score comes from Business impact; the vulnerabilities come from the confirmed matching described in How a vulnerability is matched to a server.