A vulnerability prioritization framework that survives contact with reality

Tens of thousands of CVEs are published each year, and a large share of them are rated High or Critical. If Critical means "drop everything", then a small team is permanently behind and the label stops carrying information.

CVSS answers one question well: how bad could this be if exploited? It deliberately says nothing about whether anyone is exploiting it, and nothing about whether the affected software runs anywhere in your estate.

• CVSS severity (NVD / MITRE CVE) — the impact ceiling. Use it to size the damage, not to order the queue.
• CISA KEV — a catalogue of vulnerabilities observed in real attacks. Presence in KEV is the strongest single justification for urgency.
• EPSS (FIRST.org) — a model-derived probability that a CVE will be exploited in the next 30 days. It separates the loud from the likely.
• Your own asset evidence — is the product installed, is the service listening, and is it reachable? A Critical CVE in software you do not run is not your problem this week.

Every finding lands in exactly one bucket, and each bucket carries an owner and a target time. Tune the thresholds to your own risk appetite — the point is that they are written down and applied consistently.

1. Patch now — in KEV, or high predicted exploit likelihood, and the affected component is installed and exposed. Emergency change window.
2. Investigate — high severity with meaningful exploit likelihood, but exposure or version evidence is uncertain. Confirm first, then patch.
3. Monitor — real but currently low likelihood, or installed without network exposure. Roll into the normal patch cycle.
4. Low priority — no exploitation signal and no confirmed presence in your environment. Record the decision and move on.

Three findings from one scan, all rated High by CVSS:

• A web server CVE listed in CISA KEV, on a host with the port open to the internet → Patch now.
• A library CVE with a high EPSS percentile, installed but not reachable from outside → Investigate, then schedule.
• A CVE in a product that appears only in the global catalogue and not in your inventory → Low priority, revisit if inventory changes.

Same severity, three different answers. That difference is the entire value of a prioritization framework.

1. Keep an inventory that is refreshed by scanning, not by spreadsheet.
2. Re-score weekly: KEV and EPSS both change without the CVE changing.
3. Record every decision, including the ones to do nothing.
4. Review the buckets monthly and adjust thresholds against real outcomes.

In VulnMonitor this loop is built in: the Priority Action Matrix applies the buckets, the Executive Risk Storyboard summarises them for leadership, and EPSS scores and CVSS basics are explained alongside the data.

Primary sources: CISA KEV catalogue and FIRST.org EPSS.