The CWE/SANS Top 25 is a great starting point, but each organization has its own set of business priorities, threat
environment, and risk tolerance. For those who understand those issues, a more refined and custom Top-N for their
business, and what software is doing for their business, is possible through the Common Weakness Scoring System
(CWSS) (https://cwe.mitre.org/cwss/) and the Common Weakness Risk Analysis Framework (CWRAF) (https://