If your scanner reports four thousand high severity findings, severity has stopped being useful as a way to decide what to fix on Monday. Two public data sets narrow it down quickly. CISA’s Known Exploited Vulnerabilities catalogue lists flaws with confirmed exploitation in the wild, and EPSS gives each CVE a probability of exploitation over the next thirty days. Between them they turn a backlog into a queue.
Why CVSS on its own stopped working
CVSS measures the potential impact of a flaw in the abstract, not the likelihood that anyone will use it against you. That design means huge numbers of vulnerabilities score 7.0 or above, and studies of exploitation consistently find that only a small minority of published CVEs are ever exploited in the wild. Patching in CVSS order therefore spends the first several weeks of every quarter on issues nobody has ever attacked, while an unglamorous flaw in your VPN appliance sits in the same pile. The score is still useful for describing severity in a report. It is a poor scheduler.
What the KEV catalogue changes
The KEV catalogue is a list of vulnerabilities that are known to have been exploited, maintained by CISA under Binding Operational Directive 22-01 from November 2021. Federal agencies in the United States must remediate entries by set deadlines, which is why the list is curated carefully rather than scraped. For a UK business it works as a free, high quality filter: if a CVE on your estate appears there, treat it as urgent regardless of its score. The catalogue is small enough to read, which is the point. It answers a question your scanner cannot, namely whether anyone has actually done this to someone.
“Give me the KEV entries on internet-facing systems and the rest of the backlog can wait a fortnight. Every incident I have been called into over the past two years started with something that was already on that list, usually a perimeter appliance, and usually patched everywhere except the one box nobody owned.”
William Fieldhouse, Director, Aardwolf Security Ltd
Where EPSS fits alongside it
EPSS predicts, while KEV records. The Exploit Prediction Scoring System publishes a daily probability for each CVE, built from observed exploitation data, and it is useful for the space between well known and never touched. A practical threshold many teams settle on is treating anything above 0.1, meaning a ten per cent chance of exploitation in thirty days, as a priority even without a KEV entry. Do not use it alone. A vulnerability with a low probability on a system holding your customer database still deserves a fix, which is why asset context stays in the equation.
Building the queue in practice
Sort by exposure first, then by evidence of exploitation, then by severity. Internet-facing assets with a KEV entry go to the front, followed by internet-facing assets with a high EPSS score, then internal systems with confirmed exploitation, then everything else on the normal patch cycle. Keep the Cyber Essentials rule as a floor for anything scoring 7.0 or above, since certification requires those within fourteen days. Findings from a managed vulnerability scanning service can be tagged with this context automatically, and an external network penetration testtells you which exposed hosts genuinely reach something valuable.
Frequently asked questions about vulnerability prioritisation
These questions come up whenever a security team tries to shrink a backlog.
Are EPSS and KEV free to use?
Yes. Both are published openly, and most commercial scanners can now enrich findings with them. If yours cannot, the data is downloadable and joins to your export on the CVE identifier.
Does this replace a patching policy?
No, it feeds one. Your policy still needs deadlines by severity for audit purposes. This changes the order in which work happens inside those deadlines, which is where the risk reduction comes from.
