---
title: "Contextualization of Third-Party Cloud Security Findings"
canonical: "https://sola.security/insights/contextualization-of-third-party-cloud-security-findings/"
description: "Static vendor severities ignore your environment. A study of 9,967 HIGH cloud findings shows context re-grades 3 in 4, mostly downward."
---

# Contextualization of Third-Party Cloud Security Findings

[Gal Engelberg](https://sola.security/authors/gal-engelberg/), [Leon Goldberg](https://sola.security/authors/leon-goldberg/)

|
Last updated: Oct 21, 2026

Third-party cloud security tools assign each finding a fixed severity before they ever see your environment, so the score reflects the risk of a condition in general, not the risk it poses where it actually lives. We tested what happens when severity is re-derived from environment evidence instead. A deep research agent investigates each finding against the resource’s state, its neighbors in a cross-signal asset graph, and signals from other products, then returns an adjusted severity with an evidence trace.

## Abstract

Finding severity is the main driver of how security teams prioritize remediation. For third-party cloud security findings, that severity is static: the rule that raised the finding assigns it before the rule meets any environment, so it reflects the risk of the condition in general rather than the risk the finding poses to the concrete environment where it lives. Scoring standards define where environment-specific context belongs. How far that context changes finding severities in production, where the deciding evidence lies, and whether it holds against the live environment have not been measured. We address this gap with *contextualization*, re-deriving each finding’s severity from evidence in the environment where the finding lives. A deep research agent over a precomputed cross-signal asset graph investigates each finding against the resource’s state, its graph neighborhood, and other products’ signals, and returns an adjusted severity with an evidence trace. We evaluate it in a production field study of 9,967 vendor HIGH findings from two commercial cloud security platforms across eight real production environments, on three criteria: the faithfulness of the facts behind each verdict to the live environment, the dependence of each decision on context beyond the flagged resource, and the regularity of the reasoning. Three in four findings are re-graded, mostly downward, and the same rule often moves in opposite directions inside a single environment. About half of the decisive evidence lies beyond the flagged resource, and read-only probes of live infrastructure confirm the decisive fact for 99.4% of decided findings.

## Get the full research on arXiv

Read more

[![6 strategic cybersecurity predictions for 2026 (beyond the hype)](https://sola.security/wp-content/uploads/2025/12/cybersecurity-trends-and-predictions.png) 6 strategic cybersecurity predictions for 2026 (beyond the hype)](https://sola.security/blog/cybersecurity-trends-and-predictions/)

[![AI analytics for security: Shift-left from events to exposure](https://sola.security/wp-content/uploads/2025/12/ai-analytics-for-security-1.jpg) AI analytics for security: Shift-left from events to exposure](https://sola.security/blog/ai-analytics-for-security/)

[![The cybersecurity graph in the age of LLMs](https://sola.security/wp-content/uploads/2025/08/security-graph-llms.jpg) The cybersecurity graph in the age of LLMs](https://sola.security/blog/cyber-security-graph-llms-ai/)

About the authors

[Gal Engelberg](https://sola.security/authors/gal-engelberg/)

Head of Research, Sola Security

Gal leads research at Sola, applying 13 years of AI experience from Accenture Labs to security problems. He works with deep learning, RAG, agentic systems, and knowledge graphs while completing his PhD. The goal is bridging what’s impressive in a research paper with what security teams can actually deploy on Tuesday morning.

[![Gal Engelberg on LinkedIn](https://sola.security/wp-content/themes/sola/images/ico-linkedin.svg)](https://www.linkedin.com/in/gal-engelberg/)

[Leon Goldberg](https://sola.security/authors/leon-goldberg/)

CTO, Sola Security

Leon has spent over a decade scaling security products and leading engineering teams at Cider Security, Palo Alto Networks, Red Hat, and Snyk, and now serves as CTO at Sola. When he’s not architecting complex systems, he’s probably debugging something from the back seat of a taxi.

[![Leon Goldberg on LinkedIn](https://sola.security/wp-content/themes/sola/images/ico-linkedin.svg)](https://www.linkedin.com/in/leon-goldberg/)