Prioritization: CVSS, EPSS and KEV
Deciding what to fix first.
Too Many Vulnerabilities, Too Little Time
A typical enterprise scan returns thousands of findings. You cannot fix them all at once, so prioritization decides which to remediate first. Get it right and you cut real risk quickly; get it wrong and you burn effort on theoretical issues while exploited bugs stay open.
Three data sources anchor modern prioritization: CVSS, EPSS, and KEV.
CVSS: Severity
The Common Vulnerability Scoring System (CVSS) rates the intrinsic severity of a vulnerability on a 0.0 to 10.0 scale. It considers attack vector, complexity, privileges required, and the impact on confidentiality, integrity, and availability.
CVSS answers: how bad is this if exploited? It does not tell you how likely exploitation is.
All lessons in this course
- The Vulnerability Management Lifecycle
- Scanning and Asset Inventory
- Prioritization: CVSS, EPSS and KEV
- Patch Management and SLAs