During October 2008, Microsoft Corp. had added the exploitability index with the security bulletins that it issues every month. This index has rated the bugs on a scale of 1 to 3, with a 1 which indicates that the consistently successful exploit code would be likely during the coming 30 days, and a 3 means that the working exploit code was not likely during the same period.

Its idea was actually to give its customers more of the information in order to decide which of the vulnerabilities should be patched first and before the introduction of this index, Microsoft had only offered the impact ratings like critical, important, moderate and low, and that too as an aid for its users who were puzzled by which flaws should first be fixed immediately and which ones could be set on one side for the moment.