Patch Prioritization: Why CVSS Alone Slows Down Your SOC
A SOC that treats every critical CVSS vulnerability the same patches the wrong ones first. With over 40,000 new vulnerabilities per year, closing all of them within 24 hours is simply not possible – and a CVSS score alone says nothing about which ones an attacker will actually exploit tomorrow. Anyone serious about prioritization needs two additional signals beyond severity: the probability of exploitation and whether it is already happening.
Key Takeaways
- CVSS measures severity, not urgency. A critical rating tells you how bad exploitation would be, not how likely it is. That is precisely where overloaded teams miscalculate.
- EPSS and KEV supply the missing signals. EPSS estimates the probability of exploitation; CISA’s KEV catalog shows what is already being actively exploited. Only together do they produce a meaningful order of priority.
- Tiers beat lists. A tier logic based on exploitation and impact guides the SOC through the flood instead of forcing it to work through 40,000 entries ranked by CVSS.
Related:Static third-party checks are no longer enough / The shared kernel is the gap
Why a CVSS score alone leads you astray
What is EPSS? The Exploit Prediction Scoring System assigns each vulnerability a probability between 0 and 1 that it will be exploited within the next 30 days. It answers a fundamentally different question than CVSS: not how severe the damage would be, but how likely it is to occur at all.
That distinction makes all the difference in practice. CVSS rates severity in a worst-case scenario, which is precisely why every vulnerability scan piles up dozens of entries marked critical. A team that works through that list from top to bottom spends days on gaps no one ever attacks, while a medium-severity vulnerability with an active exploit sits waiting at the bottom. Severity remains relevant – it just cannot serve as a sequencing tool on its own.
This is where operational relief becomes tangible. Deliberately pushing low-exploitation-probability vulnerabilities down the queue frees up time for weaknesses with an active or likely exploit. The prerequisite is that prioritization rests on more than a single number.
Three signals set the patch order
CVSS, EPSS, and the KEV catalog are not competing – they answer different questions. Only together do they produce a reliable priority sequence.
| Signal | Answers | Limitation |
|---|---|---|
| CVSS | How severe would the damage be? | Says nothing about likelihood |
| EPSS | How likely is exploitation within 30 days? | A forecast, not proof |
| KEV | Is it already being actively exploited? | Covers only known cases |
A vulnerability with a medium CVSS score but a high EPSS probability often warrants faster action than a critically rated one with low exploitation odds. If it also appears in the KEV catalog, the urgency is unambiguous.
Tiers bring order to what CVSS leaves open
The three signals become a manageable priority sequence once the SOC translates them into tiers. The logic below can be adjusted to your own risk appetite, but the structure stays the same.
The lowest tier is the most important source of relief. When low-EPSS items reliably flow into normal operations, analysis and patch time remains available for Tier 0 and Tier 1. Crucially, a reachable critical system elevates the tier: an actively exploited flaw on an isolated test server is not a Tier 0.
What holds the tier model up – and what breaks it down
The method stands or falls on how well it’s maintained. Three conditions determine whether the model becomes a genuine relief or just another overhead.
What holds it up
- Daily updates of EPSS and KEV data
- Asset awareness: which systems are reachable, which are critical
- Automatic enrichment instead of manual research per CVE
What breaks it down
- EPSS scores sitting months-old inside a ticket
- Tiers disconnected from actual reachability
- Exceptions that quietly become the rule
The right column describes the default trajectory: a sound model that slowly decays. A prioritization nobody maintains reverts within weeks to a plain CVSS list – just with more steps in between.
Frequently Asked Questions
Every question is locked. A tap unlocks the answer.
What is EPSS?
The Exploit Prediction Scoring System assigns every vulnerability a probability between 0 and 1 that it will be exploited within 30 days. It complements CVSS – which only measures severity – by adding the dimension of likelihood.
Does EPSS replace the CVSS score?
No. CVSS remains useful for gauging the potential impact of a successful attack. EPSS and the KEV catalog layer on top, capturing likelihood and confirmed real-world exploitation. Only the combination produces a defensible order of priority.
What is the KEV catalog?
The Known Exploited Vulnerabilities catalog, maintained by the US agency CISA, lists vulnerabilities for which active exploitation has been confirmed. A KEV entry is the strongest signal available: the question of likelihood has already been answered.
How quickly must a KEV vulnerability be remediated?
When active exploitation meets a reachable, critical system, it qualifies as Tier 0 and must be patched – or at minimum mitigated – within 24 hours. If the affected system is isolated, urgency drops accordingly.
Is the switch worth it for smaller teams?
Especially for them. Small teams can’t patch everything and benefit most from deprioritizing the roughly 90 percent of vulnerabilities that are unlikely to be exploited. EPSS and KEV data are freely available and can be integrated into existing vulnerability management tools.
More from the MBF Media Network
cloudmagazinFinOps Sees Everything, But Can’t Do Anything: Why Cloud Waste Isn’t DecreasingMyBusinessFutureTool Hygiene in Small and Medium-Sized Enterprises: 5 Hard LessonsDigital ChiefsZero Trust Requires Process Knowledge, Not Just Tools
Further reading
CI/CD Published AsyncAPI Botnet Loader
Four AsyncAPI packages with valid OIDC provenance delivered a botnet loader. The entry point was a misconfigured CI workflow.
622 CVEs: Prioritize Over Panic Patching
Record Patch Tuesday with 622 CVEs. Prioritize AD FS and SharePoint first, then exposure, then breadth—this controls the change window.
LegacyHive PoC Meets Latest Windows Patches
Public Windows EoP PoC for LegacyHive surfaces right after Patch Tuesday. Detection focuses on Hive Load and User Profile Service, hardening before exploit chains …
