A scanner returns thousands of findings, several hundred rated high or critical, against a team that can fix dozens a week. How you order that queue matters more than how fast you work through it - and CVSS alone orders it badly.
What each one actually measures
| Measures | Answers | Weakness | |
|---|---|---|---|
| CVSS | Intrinsic technical severity | How bad could this be? | Says nothing about whether anyone exploits it, or whether it is reachable in your environment |
| EPSS | Probability of exploitation in the near term | Will anyone actually use this? | A population-level estimate, not a statement about you |
| SSVC | A decision tree over your context | What should we do about it? | Requires you to supply the context, so it is effort rather than a lookup |
| KEV-style catalogues | Confirmed real-world exploitation | Is this being used right now? | Only covers what has been observed and catalogued |
The single most useful fact in this area: the overwhelming majority of vulnerabilities are never exploited at scale, while CVSS rates a large proportion of them high or critical. A queue sorted purely by CVSS is therefore mostly noise ordered confidently.
How to combine them
Treat CVSS as a floor, not an ordering:
- Confirmed exploitation on an internet-facing asset jumps the queue regardless of CVSS. This is the highest-signal input available and the list is short enough to act on.
- High EPSS means likely near-term exploitation - treat as urgent even at moderate CVSS.
- High CVSS with low EPSS and no exploitation is a normal-cadence item, not a fire drill.
- Then layer your context - exposure, asset criticality, compensating controls. A critical on an isolated internal system is not a critical to you.
Turn scan output into tracked remediation
GRC Copilot maps vulnerability and patching activity to the controls it evidences, so prioritisation decisions are recorded and auditable.
Try GRC Copilot free Generate an AI-powered assessment Download checklist Book a demo
What SSVC adds
SSVC is a decision framework rather than a score. You walk a tree using inputs you already know - is it exploited, is the system exposed, what is the mission impact, is a patch available - and it outputs an action: defer, schedule, track closely, or act immediately.
Its real advantage is that it produces a defensible decision rather than a number. When someone asks why a critical finding was scheduled for next month rather than tonight, a documented decision path answers that far better than a score comparison.
Writing it into policy
Whatever you choose, the policy has to be explicit, because your published SLA becomes your audit standard:
- Define the inputs you use and where they come from.
- Define the timelines per tier, and make them achievable - meeting a 30-day critical SLA consistently beats missing a 7-day one.
- State that confirmed exploitation overrides the normal tiering.
- Define what happens to findings you will not fix - explicit acceptance with a compensating control and an owner, not silent ageing.
The trap
Adopting EPSS to justify deprioritising almost everything, then never revisiting. EPSS scores move as exploitation emerges, so a vulnerability that scored low last month can be actively exploited today. Re-score continuously rather than at triage time only.
Frequently asked questions
Should we abandon CVSS?
No. Use it as a severity floor and a common language, not as the ordering.
Is EPSS reliable?
It is a population-level probability, not a prediction about your environment. Useful for ordering, insufficient alone.
Is SSVC worth the effort?
Where you must defend decisions - regulated environments, or anywhere findings get challenged - yes. It produces reasoning rather than a number.
What single change helps most?
Treating confirmed exploitation on internet-facing assets as an override. It is a short list and it reorders the queue meaningfully.
Key takeaways
- CVSS measures theoretical severity, not likelihood or relevance.
- Confirmed exploitation on exposed assets should override everything.
- SSVC produces a defensible decision rather than a score.
- Re-score continuously - exploitation status changes.