CVSS, EPSS, KEV: What should be fixed first?

Three signals, not interchangeable scores

CVSS describes vulnerability severity. EPSS estimates the probability that exploitation activity for a CVE will be observed in the next 30 days. The KEV catalog lists vulnerabilities with known exploitation. These signals do not measure the same property.

Why EPSS is not your organizational risk

FIRST explicitly explains that EPSS does not know your actual exposure, operational impact or compensating controls. A low score does not automatically make an affected system unimportant. Known active exploitation should not be overridden by a low prediction.

Establish applicability first

Our suggested workflow first checks product, version, prerequisites and reachability. Then consider technical impact, evidence and business criticality. Missing information belongs in the remediation plan as an open question, not in a score as an apparent all-clear.

An example without invented measurements

A severe vulnerability in a product you do not use is initially inapplicable. Demonstrable access to another customer’s data can demand immediate attention even without a CVE or EPSS score. A useful roadmap requires more than sorting a database column.

Make the decision traceable

Record the affected service, evidence, potential impact, reachable attack path and current intelligence. A subsequent report should show whether these inputs have changed. This also connects a point-in-time assessment with recurring monitoring.