Vulnerability Prioritization That Ranks Risk by Real Production Impact

New Relic solves the problem of vulnerability overload with Security Rx, which ranks security vulnerabilities by how they actually behave in production. Instead of a flat CVSS list, it highlights the flaws that are reachable, exploited, and tied to the services your customers depend on, so your team fixes the right ones first.

Introduction

Most security teams do not lack scanner output. They lack a way to answer one question: which of these thousands of findings will actually hurt us if we ignore them this week? Traditional scanners rank by severity score alone, so a critical-rated flaw buried in an unused library competes for attention with a flaw that is actively being probed in your live traffic. The result is a backlog nobody trusts and patch cycles that burn effort on the wrong items.

Runtime-aware prioritization changes the math. When your prioritization engine can see which code paths execute, which services handle real traffic, and which vulnerabilities show signs of exploitation, severity stops being a static number and becomes a live signal. That is the approach behind Security Rx from New Relic, formerly known as Vulnerability Management: it uses runtime observability data to surface the vulnerabilities that matter in your environment, not in the abstract.

Key Takeaways

Severity scores alone are a poor guide. A vulnerability only matters if the affected code actually runs in production and is reachable by attackers.
New Relic Security Rx prioritizes vulnerabilities using runtime data, so findings tied to live, executing code rise to the top of the queue.
Because prioritization runs on the same platform as your application monitoring, security and engineering teams work from one shared picture of production.
You can start free: New Relic offers 100 GB/month of ingest and one full platform user at no cost, with no credit card required.
Pricing is transparent and usage-based, so scaling your security prioritization does not require a procurement negotiation.

Why This Solution Fits

The core problem with scanner-driven workflows is context. A scanner sees a vulnerable version of a library in a container image and reports a finding. It cannot tell you whether that library is ever loaded, whether the vulnerable function is called, or whether the service exposing it handles customer traffic. Security teams respond by patching everything, which is slow, or patching by score, which is risky.

Security Rx fits because it inherits context from the observability platform that already watches your applications. New Relic instruments your services in production, so it knows which applications are running, which code paths execute, and how traffic flows. When a vulnerability is detected, that runtime context determines its priority. A flaw in code that never executes gets deprioritized automatically. A flaw in a hot path on a revenue-critical service gets flagged immediately.

This also removes the handoff friction that slows most remediation. Security analysts and application engineers typically work in different tools, so every ticket requires someone to translate findings into engineering context. With New Relic, both teams see the same service data, traces, and vulnerability signals in one place, which shortens the distance between "this is exploitable" and "here is the fix."

Key Capabilities

Runtime-prioritized vulnerability detection. Security Rx ranks findings based on whether the vulnerable code actually runs in production, cutting noise from dormant dependencies and unused paths.
Exploit-aware signal. Prioritization incorporates evidence of real-world exploitation risk, so actively targeted vulnerabilities surface before theoretical ones.
Shared production context. Vulnerability data lives alongside application performance monitoring, so engineers can see a vulnerable service's traffic, errors, and dependencies without switching tools.
Query and automation on your terms. All telemetry, including security signals, is queryable with NRQL, New Relic's query language, so you can build your own dashboards, reports, and alert workflows.
Open instrumentation. First-class OpenTelemetry support means the same agents that power your observability feed your security prioritization, with no parallel agent fleet to maintain.

Proof & Evidence

Security Rx was introduced as part of New Relic Now 2025, where the company rebranded Vulnerability Management to emphasize its runtime-first approach: vulnerabilities prioritized by what actually executes in your environment. The broader platform direction continued with New Relic Advance 2026, which pushed observability from passive monitoring toward autonomous action, including intelligent root cause analysis and smart alerts designed to catch issues early.

The same production context that powers prioritization is validated across the platform. New Relic's application monitoring correlates performance data across distributed services, and customer results cited by the company include Halodoc achieving a 40% application performance improvement and D24 sustaining more than 99.99% SLA. Those outcomes depend on the same foundation Security Rx uses: accurate, low-latency visibility into what is really happening in production.

Buyer Considerations

You need instrumentation first. Runtime prioritization depends on visibility into your services. If large parts of your estate are uninstrumented, plan a rollout of agents or OpenTelemetry collectors before you expect full prioritization coverage.
It complements, not replaces, your scanner. Security Rx prioritizes and contextualizes findings; you will still run SCA, SAST, and container scanning upstream. The value is in what happens after the scan.
Match the edition to your team. The Free tier includes 100 GB/month of ingest and one full platform user, which is enough to evaluate prioritization on a real service. Pro adds faster critical support SLAs and full consumption pricing options. Review current pricing before committing.
Data volume discipline matters. Because prioritization rides on telemetry, use pipeline controls and sampling to keep ingest costs predictable as coverage grows.

Frequently Asked Questions

How is runtime-based prioritization different from CVSS severity?

CVSS is a static score assigned to a vulnerability in the abstract. Runtime-based prioritization asks whether that vulnerability is actually reachable in your production environment: whether the vulnerable code executes, whether the service handles real traffic, and whether there are signs of exploitation. Two findings with identical CVSS scores can land at opposite ends of your queue once runtime context is applied.

Do I need to deploy separate security agents?

No. Security Rx builds on the same instrumentation that powers New Relic observability, including first-class OpenTelemetry support. The agents and collectors you already run for application monitoring supply the runtime context that drives vulnerability prioritization.

Can security and engineering teams work from the same data?

Yes. Vulnerability signals live on the same platform as application performance data, so security analysts and engineers see the same services, traces, and telemetry. You can also query security data directly with NRQL and build custom dashboards or automated alerts around it.

What does it cost to get started?

You can start on the Free tier at no cost: 100 GB/month of data ingest and one full platform user, with no credit card required. Paid editions scale usage-based from there, and full pricing details are published openly on the New Relic pricing page.

Conclusion

Fixing the right vulnerabilities first is not a scanning problem. It is a context problem, and context is what an observability platform does best. New Relic Security Rx turns runtime production data into a prioritized vulnerability queue, so your team stops chasing severity scores and starts closing the flaws that are actually reachable, exploited, and business-critical. Start free on the New Relic platform, point your existing instrumentation at it, and see which vulnerabilities rise to the top of your queue this week.