A typical KSA enterprise has 30,000 vulnerabilities at any given time across its IT estate. The CVSS-only approach to prioritization tells you to fix the high-CVSS items first. After 200 of those, the queue is empty of “criticals” but you’ve spent six months and the actual exploited vulnerabilities are still unpatched.

This is because CVSS measures theoretical severity, not real-world exploitation. A CVSS 9.8 on an internal printer that nobody can reach matters less than a CVSS 7.5 on the customer-facing web app that’s actively being exploited in the wild.

The modern stack fixes this with three signals layered on top of CVSS.

EPSS — Exploit Prediction Scoring System

Published by FIRST.org. For every CVE, EPSS predicts the probability of exploitation in the wild within the next 30 days. Updated daily.

EPSS 0.95 means there’s a 95% chance attackers will exploit this within 30 days. EPSS 0.001 means they almost certainly won’t.

This single signal replaces guessing with data.

KEV — Known Exploited Vulnerabilities

Maintained by CISA. The smaller-but-critical list of vulnerabilities confirmed to be actively exploited right now. A few hundred entries at any time.

If a vulnerability is on KEV, it’s not a question of whether it will be exploited. It already is.

Asset value — your environment’s reality

EPSS and KEV are global signals. Asset value is your local context. The same vulnerability on a forgotten dev server matters less than on the customer-facing payment gateway.

Asset value comes from your CMDB, business impact analysis, or a simple tier-based classification (mission-critical, important, supporting, deprecated).

The intersection

High EPSS × on KEV × high-value asset = fix immediately. Low EPSS × off KEV × low-value asset = defer to next cycle.

This intersection-based prioritization reduces 30,000 findings to ~30 actionable items per month. The team can actually fix what matters.

How to operationalize

Most modern scanners (Tenable, Qualys, Wiz) have EPSS/KEV enrichment built in. The discipline is: 1. Configure the enrichment 2. Build the prioritization workflow (EPSS-aware tickets, asset-value-weighted) 3. Verify remediation actually clears the finding (no auto-close on dismiss) 4. Trend the metrics (top 10 unresolved, MTTR by severity)

→ Vulnerability Management service → | Pen testing → | DFIR →