[LESSON] 03.6 Prioritization #33

Lesson

Module: 03 Detection Requirements

Lesson: 6. Prioritization

Target file: core/03-detection-requirements/06-prioritization.md

Research issue: #12

Scope

Copied from the module README, which is the source of truth. If the scope needs to change while writing, change the README in the same pull request and say why.

Learning Objectives

• Combine threat, impact, exposure, feasibility, and effort into a defensible priority for a detection requirement.
• Evaluate the strengths and failure modes of common prioritization approaches.
• Decide when a risk should be addressed through detection, prevention, or explicit acceptance.
• Communicate prioritization decisions to stakeholders in terms of risk reduction.

Key Topics

• Prioritization inputs: threat relevance, potential impact, asset exposure, telemetry feasibility, and engineering effort
• Prioritization approaches:
  • Qualitative tiers (high / medium / low)
  • Weighted scoring models
  • Threat-driven ranking (for example, prevalence of techniques in relevant threat activity)
  • Coverage-gap-driven ranking
• Failure modes:
  • Headline-driven priority: high-profile news creating pressure to act on threats with little relevance to the environment
  • Severity over exposure: letting a single input such as CVSS outrank actual exposure and exploitability
  • Remediation-only planning: relying on a long remediation effort that later stalls on an undiscovered dependency, with no interim detection in place
  • False precision in scoring models, and prioritizing what is easy to build over what matters
• Detect, prevent, or accept: when detection is the right investment and when the better answer is a preventive control or documented risk acceptance
• Re-prioritization triggers: new threat intelligence, incidents, environment changes, and remediated exposure
• Explaining priority to stakeholders: tying decisions to risk reduction rather than rule counts, and grounding responses to headline threats in actual exposure

Out of Scope

• Detailed treatment of exposure and asset risk inputs (Lesson 4)
• Assessing telemetry availability (Lesson 5)
• Program-level backlog management, capacity planning, and metrics (Module 10)

Goal of This Issue

Write the lesson. The lesson is complete when a pull request is merged that:

• adds the target file, based on templates/lesson-template.md and written to the Style Guide
• meets each learning objective above and stays out of the out-of-scope topics, pointing to the lesson or module that covers them instead
• passes the checklist for authors
• links the lesson from the module README's lesson list
• updates the module's ai_assistance field and README AI Assistance section to cover this lesson

The module's status stays draft. Technical review happens at the module level once its lessons are written (Review Process).

How to Participate

• Claim: comment on this issue to take it. A maintainer will assign you and add you to the Contributors section below. One writer leads each lesson; others are welcome to contribute.
• Collaborate: open a draft pull request early and link this issue. To let co-contributors push to your branch, add them as collaborators on your fork (fork Settings → Collaborators). Every commit must be signed off (DCO).
• Boundaries: if the lesson starts covering material owned by another lesson or module, raise it here or in the pull request rather than expanding the scope.
• Inactivity: claims with no activity for 4 weeks may be released after a reminder.

Contributors

Writer:

Contributors:

Additional Context

None yet.