A risk cohort is a group of vulnerabilities that share the same exposure pattern or deployment question, so defenders can prioritize them together. Instead of ranking fixes only by CVE count or generic severity, a cohort asks where the flaw lives: on an internet-facing service, in a client component, behind strong access controls, or in software that processes untrusted input.
This matters because two different bugs can create the same operational risk if they affect the same attack surface. For example, a local bypass, a remote code execution flaw, and a denial-of-service issue may all deserve fast action if they sit on a widely exposed system. In defense, risk cohorts help security teams build patch queues around real usage: public-facing systems first, policy-bypass issues in hardened environments next, and lower-exposure assets later. The result is faster, more practical triage during large patch releases.