Target Prioritization Section: Design Spec¶

Date: 2026-03-15 Status: Draft

Purpose¶

Add a new top-level section to the Vulnerability Research Tool Landscape site that identifies and ranks high-priority software targets for vulnerability discovery. This section serves as a bridge between the analysis sections (SWOT, Gaps & Opportunities) and the forward-looking sections (Future Frameworks, CVE & Bug Bounty Ecosystem).

While existing sections cover what tools exist, where gaps lie, and what could be built, this section answers: where should vulnerability research resources be focused to produce the largest security impact?

The section uses a reproducible, semi-quantitative scoring methodology to evaluate software targets across deployment scale, exposure, privilege level, dependency footprint, and other dimensions. It produces a prioritized target list that can inform fuzzing campaigns, static/dynamic analysis efforts, and AI/LLM-assisted vulnerability research.

Audience¶

Security researchers choosing targets for vulnerability discovery. Tool builders deciding which software ecosystems to support. Organizations prioritizing security investments. Designers of future LLM-assisted vulnerability research frameworks selecting candidate inputs.

Structure¶

New top-level nav section "Target Prioritization" with 11 pages (1 index + 1 methodology + 7 category pages + 1 target list + 1 under-researched).

Nav Placement¶

After "Gaps & Opportunities", before "Future Frameworks". Full surrounding nav context:

  # ... (preceding sections unchanged)
  - Gaps & Opportunities:
      - gaps/index.md
      - Logic Bugs: gaps/logic-bugs.md
      - Stateful Fuzzing: gaps/stateful-fuzzing.md
      - LLM Integration: gaps/llm-integration.md
      - Patch Generation: gaps/patch-generation.md
  - Target Prioritization:
      - target-prioritization/index.md
      - Methodology: target-prioritization/methodology.md
      - OS Components: target-prioritization/os-components.md
      - Networking: target-prioritization/networking.md
      - Security Libraries: target-prioritization/security-libraries.md
      - Data Parsers: target-prioritization/data-parsers.md
      - Browsers: target-prioritization/browsers.md
      - Cloud Infrastructure: target-prioritization/cloud-infrastructure.md
      - Embedded & IoT: target-prioritization/embedded-iot.md
      - Target List: target-prioritization/target-list.md
      - Under-Researched: target-prioritization/under-researched.md
  - Future Frameworks:
      - future-frameworks/index.md
      # ... (remaining sections unchanged)

Directory: docs/target-prioritization/

Pages¶

Tags¶

All pages: target-prioritization. Per-page additional tags:

Scoring Methodology¶

Criteria¶

7 dimensions, each rated 1-5:

Composite Score¶

Weighted sum, maximum 70 (minimum 14). Priority tiers:

• Critical: 55-70
• High: 40-54
• Medium: 25-39
• Low: <25

Note: Since this section covers security-critical software by definition, the "Low" tier is expected to be sparsely populated. Most targets will score Medium or above. The recalibrated thresholds ensure meaningful distribution across tiers.

Methodology Page Content¶

• Rationale for each criterion and its weight
• Why deployment scale and exposure are weighted highest (they determine blast radius)
• How to apply the rubric to new targets not covered in this section
• Limitations and caveats (scores are best-effort estimates)
• A worked example scoring one target step by step
• Mermaid flowchart showing the scoring workflow

Page Designs¶

Section Index (index.md)¶

1. Intro paragraph: Bridge narrative framed around the knowledge base's narrative arc: What tools exist (tool sections) and what's missing (gaps) determines capability. Where to focus (this section) determines allocation. What to build (future frameworks) determines investment. How discovery is incentivized (CVE ecosystem) determines sustainability. This section fills the allocation layer.

2. Scoring Overview: Brief summary of the 7-criteria methodology with link to full methodology page.

3. Key Findings Table:

   Finding	Detail	Page
   OS kernels and crypto libraries score highest	Combination of privilege, deployment, and exposure	Target List
   Parser libraries are systematically under-fuzzed	High dependency footprint, varied input formats	Data Parsers
   Embedded/IoT has lowest research coverage	Proprietary code and specialized hardware create barriers	Embedded & IoT
   Cross-industry impact concentrates in ~15 targets	A small set of foundational libraries spans all sectors	Target List

4. Reading Guide: Suggested paths for researchers, tool builders, organizational decision-makers.

5. Section Diagram: Mermaid flowchart showing how this section connects to SWOT, Gaps, Future Frameworks, and CVE Ecosystem.

6. Cross-references to other sections.

Category Pages (7 pages)¶

Each category page follows a consistent template. Target 5-8 software targets per category, ~50-60 total across all categories.

1. !!! abstract "At a Glance" -- what this category covers, why it matters, number of targets analyzed.

2. Category Overview -- what makes this class of software security-critical, common vulnerability patterns.

3. Target Analysis -- each significant software target gets:

4. Description and deployment context
5. Scoring against the 7 criteria (inline table)
6. Known vulnerability history (with sources)
7. Current fuzzing/analysis coverage status

8. Cross-references to relevant tool pages

9. Category Summary Table -- all targets in the category with composite scores and priority tier.

10. Implications -- guidance for researchers, tool builders, and organizations.

Category Scope¶

os-components.md: Linux kernel subsystems (networking, filesystem, drivers, memory management, BPF), Windows kernel and system services, macOS XNU kernel and system frameworks. Emphasis on privilege level and deployment scale.

networking.md: HTTP servers/clients (nginx, Apache, curl/libcurl), TLS libraries (OpenSSL, GnuTLS, BoringSSL, wolfSSL), DNS (BIND, Unbound, systemd-resolved), SSH (OpenSSH), email (Postfix, Exim, Dovecot), VPN (OpenVPN, WireGuard, strongSwan), QUIC (quiche, msquic, ngtcp2). Emphasis on network exposure and protocol complexity.

security-libraries.md: Crypto libraries (libsodium, Bouncy Castle, OpenSSL libcrypto), authentication frameworks (PAM, SSPI, Kerberos implementations), certificate handling (NSS, GnuTLS certtool), key management. Emphasis on dependency footprint and impact of compromise. Note: TLS libraries (OpenSSL, GnuTLS, etc.) are scored in networking.md as their primary category; security-libraries.md cross-references those entries when discussing the dependency angle but does not re-score them. Targets appearing in multiple categories are scored once in their primary category and cross-referenced elsewhere. The master target table in target-list.md deduplicates.

data-parsers.md: Image (libpng, libjpeg-turbo, libwebp, ImageMagick), video (FFmpeg, libav, GStreamer), archive (libarchive, zlib, bzip2, xz/liblzma), document (Poppler, PDFium, libxml2, Expat), compression (zstd, lz4, snappy). Emphasis on processing untrusted input and wide embedding in downstream applications.

browsers.md: JavaScript engines (V8, SpiderMonkey, JavaScriptCore), rendering engines (Blink, Gecko, WebKit), WebAssembly runtimes, browser networking stacks, media decoders within browsers. Emphasis on codebase complexity and attack surface breadth.

cloud-infrastructure.md: Container runtimes (containerd, CRI-O, runc), hypervisors (KVM/QEMU, Xen, Hyper-V), orchestration (Kubernetes, Nomad), service meshes (Envoy, Istio, Linkerd), API gateways (Kong, NGINX Plus, Traefik). Emphasis on deployment in critical infrastructure and privilege boundaries.

embedded-iot.md: Firmware (U-Boot, EDK II/UEFI), industrial protocols (Modbus, OPC UA, DNP3), automotive (AUTOSAR, CAN bus implementations), router/firewall firmware (OpenWrt, pfSense, vendor firmware), RTOS (FreeRTOS, Zephyr, VxWorks). Emphasis on under-researched status, real-world impact, and barriers to research.

Target List Page (target-list.md)¶

1. !!! abstract "At a Glance" -- total targets scored, distribution across priority tiers.

2. Master Target Table -- all targets from all category pages, sorted by composite score:

   Rank	Software	Category	Deploy	Platform	Exposure	Privilege	Deps	Complexity	CVE History	Score	Priority

3. Cross-Industry Analysis -- table mapping targets to industries (finance, healthcare, telecom, manufacturing, cloud, consumer). Cells contain checkmarks indicating the target is deployed in that industry, or are empty if not applicable. Identifies software where a single discovery protects multiple sectors.

4. Priority Tier Breakdown -- Vega-Lite bar chart showing distribution of targets across Critical/High/Medium/Low, grouped by category.

5. Recommendations -- top 10-15 highest-priority targets with brief rationale, organized by:

6. For fuzzing campaigns
7. For static/dynamic analysis

8. For AI/LLM-assisted research

9. Connection to Future Frameworks -- maps priority targets to framework architectures in Future Frameworks section.

Under-Researched Page (under-researched.md)¶

1. !!! abstract "At a Glance" -- focus on high-value targets with disproportionately low security research coverage.

2. Identification Criteria -- signals of under-research: few published CVEs despite complexity, limited fuzzing harness availability, no OSS-Fuzz integration, complex codebases with minimal security audit history.

3. Under-Researched Target Catalog -- each as !!! opportunity admonition with:

4. The software and why it's under-researched
5. Its composite score from the methodology
6. Estimated difficulty of researching it

7. Potential impact of findings

8. Barriers to Research -- why targets get less attention: proprietary code, specialized hardware, niche expertise, legal concerns.

9. Recommendations -- where research investment would have outsized returns.

Diagrams¶

Glossary Additions¶

New terms to add to docs/glossary.md (both table entries and *[TERM]: definitions):

Check existing glossary before adding; skip terms already defined.

Bidirectional Cross-References¶

After creating the section, update these existing pages with backlinks:

• gaps/index.md -- reference Target Prioritization as the "where to focus" complement
• swot/opportunities.md -- reference the prioritized target list
• future-frameworks/index.md -- reference as input for framework target selection
• cve-ecosystem/opportunities.md -- reference target prioritization for directing AI-assisted research (only if page exists; CVE ecosystem section may be built concurrently)
• overview/landscape.md -- reference as the target selection layer of the landscape

Content Standards¶

Same as existing site:

• YAML frontmatter with tags: on every page
• No emojis, no em dashes (use colons, commas, parentheses instead)
• Inline citations with markdown links for factual claims
• !!! warning "Knowledge Gap" for uncertain data
• Cross-references using relative links to existing pages
• Custom admonitions (opportunity, gap, threat, pain-point) used where appropriate
• Best-effort real data with Knowledge Gap flags where uncertain
• All "At a Glance" blocks use !!! abstract "At a Glance" consistently
• Index page uses default template (no template: frontmatter)

Content Boundary: Category Pages vs. Target List¶

Category pages own the detailed analysis of each target (description, scoring breakdown, vulnerability history, fuzzing coverage). The target list page is a synthesis that consolidates scores into a single ranked table and adds cross-industry analysis. The target list should not duplicate category-page analysis; it references back to category pages for details.

Content Boundary: Under-Researched vs. Category Pages¶

Category pages note current research coverage for each target as part of the analysis. The under-researched page pulls out and highlights the subset of targets where coverage is disproportionately low relative to their score, adds analysis of barriers, and makes investment recommendations. It is a curated view, not a repeat.

Differentiation from Existing Sections¶

The narrative connection: What tools exist (tool sections) and what's missing (gaps) determines capability. Where to focus (this section) determines allocation. What to build (future frameworks) determines investment. How discovery is incentivized (CVE ecosystem) determines sustainability.

Estimated Total Output¶

• 11 new pages
• ~12,000-15,000 words total
• 4 diagrams (2 Mermaid, 2 Vega-Lite)
• Cross-references to 15+ existing pages
• 6+ new glossary entries

tags: - glossary

Glossary¶