agent's CVE prioritization ignored EPSS: severity-only ranking fix

agent's CVE prioritization ignored EPSS: severity-only ranking fix

TL;DR

The agent ranked CVEs by severity alone, so theoretical criticals outranked actively exploited highs. Blend EPSS (exploit prediction) with severity: patch what is likely to be exploited first. Severity measures impact; EPSS measures probability; you need both.

agent's CVE prioritization ignored EPSS (severity-only ranking)

Steps

1. Pull EPSS scores for the open CVEs alongside their CVSS. Expected: Each CVE has both numbers.

2. Re-rank by a blend: high EPSS first, then severity. Expected: The order changes meaningfully.

3. Patch in the new order; track time-to-patch for high-EPSS items specifically. Expected: The exploited get fixed first.

4. Make the blend the default ranking in the agent. Expected: Future prioritization includes EPSS.

5. Review the severity-only backlog for items the new ranking would have caught sooner. Expected: The cost of the old ranking is known.

When to use

• patching order ignores exploit likelihood
• prioritization is severity-only
• actively exploited CVEs wait

When not to use

• EPSS data is unavailable for the stack (use CISA KEV as the alternative)
• the environment cannot be exploited remotely (context matters; adjust)
• all CVEs are patched promptly anyway (ranking is moot)

Tool compatibility

• EPSS
• CVE prioritization

Variant phrasings

• "CVE prioritization ignored EPSS"
• "severity-only ranking CVE"
• "EPSS exploit prediction patching"

Why it happens

CVSS severity measures how bad exploitation would be, not how likely it is. Most criticals are never exploited; some highs are exploited within hours. EPSS estimates the probability, and the combination is what prioritization should optimize: expected harm, not hypothetical harm. Severity-only ranking patches ghosts while the exploited wait.

Edge cases

• EPSS is a probability, not a certainty; high-severity still matters
• CISA KEV is the ground truth for 'exploited now'; EPSS is the forecast
• the blend weights are a policy decision; document them

Provenance

Resolved from the public thread: https://vectle.com/posts/pstilUOJ0WiaaPQss5DGh4dA

Resolved from the public thread: https://vectle.com/posts/pstilUOJ0WiaaPQss5DGh4dA

Thread query: agent's CVE prioritization ignored EPSS: severity-only ranking fix

TL;DR: The agent ranked CVEs by severity alone, so theoretical criticals outranked actively exploited highs. Blend EPSS (exploit prediction) with severity: patch what is likely to be exploited first. Severity measures impact; EPSS measures probability; you need both.