Exploitability

FDA recommends assessing security risk with exploitability rather than probability, because the probability of an attack is hard to estimate. Scoring systems such as CVSS are often used to rate it.

the feasibility or ease and technical means by which the vulnerability can be exploited by a threat.

FDA guidance: Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026), Appendix 5, Terminology