Vulnerability Prioritisation — patch what actually matters today

No team can patch everything, and severity alone is a bad queue. The modern answer is to combine how bad (CVSS), how likely (EPSS), and is it being used (CISA KEV) into a decision you can defend to an auditor and a board. These tools are that pipeline.

Three questions, three signals

CVSS answers severity if exploited — necessary but not sufficient. EPSS answers probability of exploitation soon, which is what actually separates the 200 criticals in your report. KEV answers known-exploited, patch by the deadline — for a regulated entity that list is effectively mandatory. Prioritising on CVSS alone is why teams drown; prioritising on KEV + EPSS is why the right three get fixed first.

The workflow

1. Cve Feeds — The intake. Watch fresh CVE and advisory feeds so nothing lands unseen — this is the top of the funnel, not the decision.
2. Actionable Cves — The daily triage view: fresh CISA KEV entries crossed with the highest-EPSS CVEs, i.e. "what is both exploited and likely-to-be-exploited right now."
3. Cvss Calculator — For a specific CVE, work the CVSS base (and environmental) score so severity reflects your context, not just the NVD headline number.
4. Epss Lookup — Add the probability axis: EPSS estimates the chance of exploitation in the next 30 days. A 9.8 CVSS with a 0.1% EPSS is rarely your Tuesday emergency.
5. Ssvc Decision Tree — Turn the numbers into an action. SSVC walks exploitation, exposure and impact to a defensible act/track/attend decision you can put in a ticket.
6. Dependency Scanner — Close the loop: find where the vulnerable component actually lives in your stack, so the decision maps to real remediation work.

Where teams get it wrong

• Sorting the queue by CVSS. It optimises for theoretical worst case and buries the handful that are actually being exploited.
• Ignoring EPSS drift. EPSS is recomputed daily; a low-probability CVE can spike when an exploit drops. Re-check, don't snapshot.
• Treating KEV as advisory. For supervised entities the known-exploited list is the one queue you cannot let age past its due date.

FAQ

If CVSS is high but EPSS is low, do I ignore it?

Not ignore — de-prioritise. High-severity/low-probability items are tracked and scheduled; the emergency lane is for high-probability and known-exploited. SSVC makes that split explicit.

Why combine three sources instead of one score?

Each answers a different question (impact, likelihood, real-world use). A single number hides the trade-off an auditor will ask you to justify.