Beyond CVSS: Using EPSS, CISA KEV, and Reachability Analysis for Risk-Based Vulnerability Management
More than 35,000 CVEs are published every year, and over half carry a 'High' or 'Critical' CVSS score. Yet fewer than 5% are ever exploited. Here is the decision matrix that fixes what attackers actually use.
If your vulnerability management policy says "remediate all CVSS 7.0+ vulnerabilities within 14 days," one of two things is happening in your organisation: either your engineering teams are spending half their sprints patching unexploited dependencies while product roadmaps stall, or the SLA is quietly ignored and exceptions pile up in spreadsheets. The root cause is mathematical: CVSS measures theoretical severity assuming an exploit already exists, not the likelihood of real-world exploitation.
The Four-Dimensional Vulnerability Prioritization Matrix
| Signal | Question It Answers | Authoritative Source |
|---|---|---|
| 1. Confirmed Exploitation | Are threat actors actively exploiting this CVE right now? | CISA Known Exploited Vulnerabilities (KEV) Catalog |
| 2. Exploitation Probability | How likely is this CVE to be exploited in the next 30 days? | FIRST.org Exploit Prediction Scoring System (EPSS) |
| 3. Network & Function Reachability | Is the asset internet-facing, and does our code invoke the vulnerable function? | CNAPP / ASM exposure graph + Call-graph SCA |
| 4. Asset Criticality | Does this system process regulated data or hold Tier 0 credentials? | Internal CMDB / Cloud Tagging & CIEM blast radius |
How Combining CVSS + EPSS + KEV Changes the Workload
Empirical research from FIRST.org and Cyentia Institute demonstrates that remediating only CVSS 7.0+ vulnerabilities catches roughly 80% of exploited flaws—but forces teams to patch more than 50% of all published CVEs (low efficiency). By contrast, prioritizing vulnerabilities that are in CISA KEV OR have an EPSS score ≥ 10% (0.10) captures comparable real-world threat coverage while slashing emergency remediation volume by more than 80%.
Practical SLA Tiers That Engineering Teams Respect
- Tier 1 — Immediate / Emergency (48–72 Hours): CVE is present in CISA KEV or EPSS ≥ 0.50 on an internet-reachable asset or edge appliance (VPN, firewall, public API).
- Tier 2 — Urgent (14 Days): CVSS ≥ 7.0 and EPSS ≥ 0.10 with confirmed code/network reachability, or any privilege-escalation flaw on a Tier 0 / crown-jewel system.
- Tier 3 — Scheduled Sprint Hygiene (30–60 Days): Reachable CVSS High/Critical findings with low EPSS (< 0.10), resolved systematically via automated base-image rebuilds and Dependabot/Renovate pull requests.
Build a Vulnerability Programme Engineers Actually Trust
We help security and platform teams replace noisy CVSS backlogs with automated EPSS, CISA KEV, and reachability-driven prioritization.
Kinematic Digital designs and operates enterprise cybersecurity programmes, from cloud posture and identity hardening to offensive validation. Explore our cybersecurity services and preemptive cybersecurity programme, or schedule an executive security briefing.
Frequently Asked Questions
Why is CVSS alone a poor way to prioritize vulnerability patching?
CVSS measures theoretical technical severity, not whether an exploit exists or is being used in the wild. Over 55% of all published CVEs are scored CVSS High or Critical, yet fewer than 5% are ever exploited in real attacks.
What is EPSS (Exploit Prediction Scoring System)?
Managed by FIRST.org, EPSS uses machine learning and daily threat intelligence to estimate the probability (from 0% to 100%) that a specific CVE will be exploited in the wild within the next 30 days.
What is the CISA Known Exploited Vulnerabilities (KEV) catalog?
An authoritative list maintained by CISA of vulnerabilities that have confirmed evidence of active exploitation in real-world cyberattacks. Any KEV finding in your environment should be treated as an immediate remediation priority.
What is reachability analysis in software composition analysis (SCA)?
Reachability analysis inspects your application's call graph to determine whether your code actually calls the vulnerable function inside an open-source library. If the vulnerable function is never invoked, the risk is drastically lower.
How should we structure risk-based patching SLAs?
Reserve 48-to-72-hour emergency SLAs for CVEs on internet-facing assets that are in CISA KEV or have an EPSS score above 0.50. Standardize 14-to-30-day SLAs for reachable high-severity vulnerabilities, and handle the rest in routine image rebuilds.