Vulnerability management
The National Vulnerability Database publishes roughly 3,000 new CVEs a month. Research behind exploit-prediction models has shown for years that only a small fraction of all CVEs — on the order of a few percent — are ever observed being exploited in the wild. Those two facts together define the real job of vulnerability management: it is not "patch everything," because nobody can. It is find the few percent, fast, with evidence you can defend in front of an auditor or a CISO.
Two free, public signals do most of that work, and many teams still use neither.
The Known Exploited Vulnerabilities catalog is a curated list containing only vulnerabilities with reliable evidence of active exploitation. It is deliberately conservative: inclusion means someone is actually using this against real targets, not that exploitation is theoretically possible.
That makes KEV the strongest single "patch this now" signal that exists. If a CVE in your environment is on KEV, the debate is over — the only open question is your remediation timeline. KEV entries also flag known use in ransomware campaigns, which is exactly the qualifier a payment company's risk register cares about.
The limitation is the flip side of the strength: KEV is reactive. A vulnerability appears only after exploitation is observed and verified. For everything not (yet) on the list, you need a forward-looking signal.
The Exploit Prediction Scoring System, maintained by FIRST, takes the opposite approach: a model that estimates, for every published CVE, the probability of exploitation activity in the next 30 days. Instead of a binary list you get a score from 0 to 1, refreshed daily.
EPSS is what lets you triage the thousands of CVEs that are not on KEV. A CVE with an EPSS score of 0.9 deserves attention this week even if no agency has confirmed exploitation yet; a CVE at 0.005 — which is most of them — can usually wait for the normal patch cycle, regardless of how scary its severity score looks.
CVSS measures theoretical severity — what an exploit could do — not the likelihood anyone will build and use one. Huge numbers of CVEs are rated High or Critical by CVSS, and treating severity as priority produces backlogs of thousands of "criticals" that teams learn to ignore. Severity tells you the blast radius; KEV and EPSS tell you whether anyone is lighting the fuse. You need both, but the fuse matters more for ordering the queue.
This is the logic behind the live feed on our homepage: the handful of CVEs shown there are KEV entries enriched with EPSS probabilities — the same two signals, doing in public what your internal pipeline should be doing against your own asset list.
We build prioritization pipelines on exactly these signals — wired into your scanner, your SIEM, and your ticketing — so your team patches what attackers actually use.
Book a free assessment call