Victim scoring is a ranking method used by attackers to sort compromised systems by value, access, or usefulness. Instead of treating every infected host the same, operators assign priority based on signals such as stored credentials, business role, network reach, privilege level, or the presence of high-value applications and data.
This matters in cyber security because it helps explain why some victims are quickly exfiltrated, reused, or sold while others are ignored. In real attacks, scoring can guide ransomware operators to the most disruptive targets, steer credential thieves toward machines with cloud or email access, or help fraud crews focus on systems that can be used for proxying and lateral movement. Defenders may also use similar scoring to triage incidents, but for attackers it is a workflow tool that makes operations faster and more profitable. When malware advertises “AI victim scoring,” it often means automated prioritization rather than a new exploitation technique.