Prioritizing With Context
A dashboard with 4,000 criticals is not a plan. Context tells you which forty to fix first.
What you will learn
- -Read a CVSS score for what it is and what it is not
- -Use EPSS and the CISA KEV catalog to find what is actually being exploited
- -Weight findings by asset exposure and value, not severity alone
You open the dashboard to 4,000 findings marked Critical and a team of three. Sort by CVSS and you will patch in severity order until you retire, while the one vuln attackers are actually firing sits at position 900 because its score is a 7.5. Severity is not . Prioritization is the skill that separates a program that reduces risk from one that just generates work.
CVSS is severity, not your to-do list
The CVSS base score measures how bad a vuln is in the abstract: how hard it is to and how much damage a successful hit does. That is genuinely useful, and it is also where most programs stop, which is the mistake. A 9.8 on an isolated internal test box with no exploit in existence is less urgent than a 7.5 on your internet-facing auth that is being exploited this week. The base score cannot see the exploit, the exposure, or whether the matters.
EPSS: is anyone actually exploiting it
EPSS, the Exploit Prediction Scoring , gives each CVE a probability from 0 to 1 that it will be exploited in the wild within the next 30 days. FIRST rebuilds it daily from real exploitation . The number that reframes your whole backlog: most CVEs are never exploited at all. So an EPSS of 0.02 on a scary-looking 9.8 tells you to slow down and go look at the 0.90s first.
CISA KEV: stop guessing, it is confirmed
The CISA Known Exploited Vulnerabilities catalog lists CVEs confirmed exploited in the wild. If a CVE is on KEV, the question "is this just theoretical" is already answered: no, it is being used right now. KEV entries jump the queue, full stop. For US federal agencies they carry a binding remediation deadline, and that is a reasonable bar for anyone to borrow.
$curl -s 'https://api.first.org/data/v1/epss?cve=CVE-2021-44228'$grep CVE-2021-44228 known_exploited_vulnerabilities.csvAsset context: exposure and value
Two with the identical CVE are not the identical risk. The internet-facing one an attacker can reach right now outranks the one buried three segments deep. The database holding customer PII outranks the print server nobody would bother with. Fold in exposure and business value as the multiplier on top of exploitability.
A workable ordering: KEV-listed or high EPSS first, then CVSS severity, then asset exposure and criticality to break ties and push the reachable, high-value targets up. Run your 4,000 criticals through that and you a short list you can actually clear this sprint, instead of a wall you stare at.
The Critical label your scanner stamps on a finding is the raw CVSS base score with none of your context in it. Two findings with the same score can be a five-alarm fire and a shrug. Re-rank with EPSS, KEV, and where the asset actually sits before you assign a single ticket.
CVE-A is CVSS 9.8, EPSS 0.03, on an isolated internal host. CVE-B is CVSS 7.5, on the CISA KEV list, on an internet-facing server. Which do you fix first?