Different Approaches to Vulnerability Prioritization

Omer Tal

Aug 20, 2023

7min read

This article explores several methods to measure vulnerability severity, and compares them using real data which helps make vulnerability prioritization easier.

In an ideal world, a security team would be able to address every vulnerability detected within their organization. However, the reality is that an average organization may face hundreds of thousands or even millions of unpatched vulnerabilities. Therefore, it is crucial to prioritize vulnerabilities based on their threat level to the organization’s security. Consider the significance of the affected systems and the impact to business objectives as a whole and regulatory compliance.

There are two main factors to consider for within your vulnerability management process. The first factor is where the vulnerability is found. Is it on a business-critical asset or a development server? Is the asset exposed to the internet or protected by multiple layers of security? Incorporating business context into vulnerability prioritization helps align security efforts with business goals and addresses potential impacts on customer trust.

The second factor is the severity of the vulnerability itself. Can it allow complete control over the asset or only lead to information/sensitive data leakage? Is it easy or even possible to exploit? Does it require privileges or can it run remotely? What if it is already being exploited in the wild?

In this article, we will focus on the second factor, explore several methods to measure vulnerability severity, and compare them using real data.

Vulnerability Scoring Models

Over the years, different organizations have developed various vulnerability scoring models to measure the severity of vulnerabilities. The following are the most widely used methods today:

CVSSv3.1– “Common Vulnerability Scoring System“

Released in 2019 (v3.0 in 2015) by FIRST, CVSS Base Score aims to measure the technical severity of a vulnerability.

The score consists of two groups of metrics:

• Impact metrics – measures what the vulnerability allows an attacker to do in three metrics: Confidentiality, Integrity, and Availability
• Exploitability metrics – measure how easy it is to exploit the vulnerability, considering four metrics: Attack Vector, Attack Complexity, Privileges Required, and User Interaction

These metrics form a CVSS Vector which, using a public equation, calculates a CVSS Base Score ranging from 0 to 10.

Different organizations use this method to calculate and publish CVSS Base Score, but the most commonly used is the NVD Vulnerability Database.

While CVSS Base Score covers many aspects of a vulnerability, it’s still missing some and often accused of being outdated or misleading, see:

• Why You Need to Stop Using CVSS for Vulnerability Prioritization
• 5 Reasons to Stop Using CVSS Scores to Measure Risk
• CVSS Vulnerability Scores Can Be Misleading: Security Researchers
• A Case Against CVSS: Vulnerability Management Done Wrong

CVSS critics usually argue it measures theoretical severity rather than actual risk. For example, an RCE that requires no privileges or user interaction will get a CVSS score of around 9 or more, but if this vulnerability is theoretical and considered to be impossible to exploit, it will still get a critical CVSS score, while there is no reason to rush to remediate it. Also, CVSS Base Score does not change if new exploits are discovered, making prioritizing vulnerabilities even more challenging.

CVSS attempts to address these concerns with the “CVSS Temporal Score” which reflects the changing characteristics of a vulnerability over time by incorporating metrics such as Exploit Maturity, which we will discuss soon.

EPSS– Exploit Prediction Scoring System

First released in 2021 by the FIRST organization, the Exploit Prediction Scoring System (EPSS) is a data-driven approach that aims to estimate the likelihood, or probability, of a software vulnerability being exploited in the wild within the next 30 days. Each vulnerability is assigned a score ranging from 0 to 1, representing the probability of exploitation, along with a percentile indicating its relative score compared to other vulnerabilities.

EPSS addresses a major concern with CVSS (Common Vulnerability Scoring System) by providing daily updates and assessing the actual risk of a vulnerability being exploited. However, EPSS does not take into account the impact of a vulnerability, which could pose the risk of neglecting critical vulnerabilities. This means that even a vulnerability with very low impact could have a high EPSS score, but it does not necessarily imply that immediate remediation is required.

It is important to note that there is a strong correlation between a CVSS Base Score and an EPSS score. This correlation exists because attackers tend to target vulnerabilities that have a significant impact or are easier to exploit, which are the factors considered in the CVSS score.

CISA KEV – Known Exploited Vulnerabilities Catalog

Released by the Cybersecurity and Infrastructure Security Agency (CISA) in 2021, the Known Exploited Vulnerabilities (KEV) Catalog is not a scoring system but rather a list of vulnerabilities with substantial evidence of active exploits in the wild. Although the catalog contains fewer than 1,000 CVEs, all of them are known to have been exploited.

Similar to EPSS, the KEV catalog does not take into account the impact of the vulnerabilities. However, there is a strong correlation with CVSS scores for the same reason as in EPSS: attackers are more likely to exploit vulnerabilities with significant impact.

Exploit Maturity / Exploit Code Maturity for Vulnerability Management

The concept of exploit maturity or exploit code maturity is a specific threat intelligence metric that reflects the current status of exploit techniques, availability of exploit code, or the extent of active exploitation observed in real-world scenarios (“in-the-wild” exploitation).

This metric can be incorporated into various scoring systems, such as the CVSS Temporal Score or certain vendor-specific scoring systems.

The official CVSSv3.1 scale for this vulnerability management metric includes the following levels: Unproven, Proof-of-Concept, Functional, High.

Alternatively, other scales may utilize terms like “Weaponized” and “Exploited In the Wild” to describe different stages of exploit maturity.

While EPSS aims to predict the existence of a mature exploit, this particular method focuses on assessing the current state of exploitation for a vulnerability.

A Deep Dive Analysis on Scoring Methods for Vulnerability Prioritization

To better understand the relationship between these different scoring methods, we collected data on ~34,000 vulnerabilities published since 2020 from various leading vulnerability management vendors.

Each vendor uses a different scale for “Exploit Maturity” so we normalized it to the CVSS scale of: Unknown, Proof of Concept, Functional, High.

We enriched the data with EPSS Percentile from the FIRST API and “Known Exploited Vulnerabilities” from CISA.

The data is presented in the following Sankey Diagram that visualizes the connections between CVSS, Exploit Maturity, EPSS, and KEV.

Based on this diagram, we can draw the following conclusions:

• The criticisms against CVSS seem valid. Approximately half of the vulnerabilities rated as High/Critical do not have any evidence of exploitation according to the “Exploit Maturity” scale. Only a small portion have a “High” Exploit Maturity rating.
• EPSS is not effective at identifying vulnerabilities that are already being exploited. A significant number of CVEs with very low EPSS scores in the bottom 80% have strong evidence of exploitability based on Maturity or KEV. This is not surprising, as First states “EPSS is best used when there is no other evidence of active exploitation”.
• Most CVEs lack evidence of exploitability (not listed in KEV and have an “Unknown” maturity rating). For these CVEs, EPSS is the only method available to assess exploitability, providing additional information where Maturity/KEV falls short. The “Unknown”/”False” CVEs are distributed evenly among different EPSS percentiles, which can aid in prioritization.

So, How Should One Prioritize Vulnerabilities?

Security teams face the challenge every day of helping identify vulnerabilities, addressing vulnerabilities, and leading remediation efforts to protect sensitive data and minimize business impact. However, effective vulnerability prioritization can be difficult and requires the use of a concrete system for scoring and prioritizing vulnerabilities. Each scoring system has its pros and cons, with one system compensating for the limitations of another. Therefore, the most comprehensive approach to prioritizing vulnerabilities is to use all these methods together for the most effective vulnerability management.

Relying solely on one scoring system can result in blind spots and an incomplete understanding of the overall risk. Every organization is different, and a scoring system that works for one may not work for another. However, here is an example of a vulnerability prioritization process:

Please note that this is just an example, and each organization should choose appropriate thresholds and methods that align with their needs and specific threats.

AI-Driven Vulnerability Prioritization at Scale

Combining multiple scoring systems provides a more comprehensive view of risk, but executing that approach consistently across complex environments requires more than static rules and workflow automation.

Traditional automation helps enforce predefined logic: if a vulnerability meets certain thresholds, route it here; if it exceeds a severity score, escalate it there. That’s valuable, but it’s still rule-based. It depends on conditions teams explicitly define in advance.

AI-driven prioritization goes a step further.

Rather than simply applying fixed criteria, AI models analyze patterns across large volumes of historical and real-time data to detect relationships that aren’t always obvious. This includes correlations between exploit trends, asset behavior, remediation timelines, exposure paths, and emerging threat intelligence.

For example, AI can:

• Identify combinations of signals that historically preceded active exploitation.
• Detect anomalies in vulnerability clustering across environments.
• Adjust prioritization dynamically as exploit activity or exposure patterns shift.
• Learn from remediation outcomes to refine future prioritization accuracy.

In this way, AI enhances scoring frameworks like CVSS, EPSS, and KEV by introducing adaptive, data-driven decision support, not just faster execution of predefined rules.

In fast-moving environments where exposure data changes daily, this adaptive capability helps ensure prioritization remains aligned with evolving real-world risk, rather than relying solely on static thresholds or manual tuning.

Conclusion

Organizations face an overwhelming number of risks today, making it difficult for them to address their growing findings backlog. Security teams play a crucial role in vulnerability management and prioritization, efficiently identifying and addressing high-risk vulnerabilities while balancing organizational resources and the urgency of remediation based on the threat landscape.

To operate effectively, they need a systematic way to apply all of the criteria described in this article using a uniform scale – regardless of the security solution or vendor that detected each risk. Organizations also need a way to apply the various prioritization methods in a way that works best for them and is aligned to their unique set of risks.