A 0–10 score per device from four things that actually make an asset dangerous to keep: how far past support it is, which exploitable or known-exploited CVEs it carries as configured, how critical it is to the business, and whether fixes will ever ship for it.