| name | vulnerability-prioritization |
| description | Rank a set of vulnerabilities by real-world risk using CVSS (severity), EPSS (exploit probability), CISA KEV (known exploited), and asset/exposure context — so remediation effort goes to what actually matters first. Use when a triaged finding list needs a defensible "fix this first" order. |
Goal
A risk-ranked, defensible remediation order — not just "sort by CVSS" — that a team
can act on and an auditor can understand.
The signals (combine, don't rely on one)
- CVSS base — technical severity / worst-case impact. A ceiling, not a priority.
- EPSS — probability the CVE is exploited in the wild in the next 30 days. Cuts
the long tail of high-CVSS-but-never-exploited bugs.
- CISA KEV — on the Known Exploited Vulnerabilities catalog ⇒ treat as top
priority regardless of CVSS; active exploitation is confirmed.
- Asset context — criticality, internet exposure, data sensitivity, and
compensating controls. An internal, segmented, low-value host changes the math.
- Exploit maturity / threat intel — public PoC, weaponized, ransomware use
(pair with
threat-intelligence).
Steps
- Pull CVSS, current EPSS score, and KEV membership for each CVE.
- Apply a tiering rule, in order:
- P1 / now: on CISA KEV, or (internet-exposed AND high EPSS AND high impact).
- P2 / SLA-fast: high EPSS or critical CVSS on important assets.
- P3 / scheduled: everything else, ranked by EPSS then CVSS.
- P4 / accept or defer: low impact, low EPSS, well-mitigated, non-prod.
- Adjust for asset context (exposure, criticality, compensating controls) — document
every up/down adjustment so the ranking is auditable.
- Map each tier to a remediation SLA and route to
remediation-tracking.
Output
A ranked list with, per item: identifier · CVSS · EPSS · KEV(y/n) · asset context ·
assigned tier · SLA · one-line justification. Note any risk-accepted items with owner
and review date.
Notes
CVSS alone over-prioritizes: most high-CVSS CVEs are never exploited. EPSS + KEV is
what separates theoretical from real risk. KEV is non-negotiable — if it's being
exploited in the wild, severity score is irrelevant. Re-score periodically: EPSS and
KEV change over time, so today's P3 can become tomorrow's P1.
