Beyond CVSS: Smart Vulnerability Prioritization
With 25,000+ CVEs published annually, organizations cannot patch everything immediately. The traditional approach of prioritizing by CVSS score leads to alert fatigue: over 50% of CVEs score 7.0+ (High or Critical), but fewer than 5% are ever exploited in the wild.
Modern Prioritization Signals
EPSS (Exploit Prediction Scoring System)
Machine learning model predicting exploitation probability in the next 30 days:- Score 0.0 to 1.0 (probability)
- Updated daily based on exploit activity
- Dramatically reduces prioritization noise
KEV (Known Exploited Vulnerabilities)
CISA's catalog of actively exploited CVEs:- Federal agencies must patch within defined timelines
- Direct evidence of real-world exploitation
- Smaller, actionable list (~1,100 entries)
Weaponization Signals
- Public exploit code available (Exploit-DB, GitHub)
- Metasploit module published
- Mentioned in ransomware campaign reports
- Sold on dark web exploit marketplaces
Contextual Risk
Your specific environment factors:- Is the vulnerable software internet-facing?
- Is it in a critical system?
- Are compensating controls in place?
- What's the blast radius if exploited?
Prioritization Matrix
| Priority | Criteria | SLA |
|---|---|---|
| P0 | KEV + Internet-facing + No compensating control | 24 hours |
| P1 | EPSS > 0.5 + Critical asset | 7 days |
| P2 | CVSS 9+ + EPSS > 0.1 | 30 days |
| P3 | CVSS 7+ + Internal only | 90 days |
| P4 | CVSS < 7 + Low EPSS | Next cycle |
Implementation
- Aggregate vulnerability data from all scanners
- Enrich with EPSS scores and KEV status
- Apply contextual risk factors from asset inventory
- Calculate composite priority score
- Route to responsible teams with SLA deadlines
- Track remediation velocity metrics
SuperClue Vulnerability Intelligence
SuperClue adds FIRST EPSS scores and CISA KEV status to CVE findings and parses CVSS v4 vectors, so you can rank fixes by real-world exploitation risk rather than severity alone.