How to prioritise vulnerabilities: a practical playbook

Start from the attacker’s view

Attackers do not sort findings by CVSS. They use exploits that work against systems they can reach, and that route has just taken the lead. Verizon’s 2026 DBIR puts exploitation of vulnerabilities at 31% of breaches as an initial access vector, up from 20% the year before and now the single most common way in. Credential abuse, the previous leader, reads 13% as a first action and phishing 16%. Read the credential drop carefully: the DBIR added Pretexting to its tracked vectors this year, and says credential abuse would have been 16% without that change – and that it still appears somewhere in 39% of breaches.

ENISA’s Threat Landscape 2025, drawn from 4,875 incidents between 1 July 2024 and 30 June 2025, puts exploitation of vulnerabilities at 21.3% of intrusion vectors, behind phishing at roughly 60%. Its more useful finding is what happens afterwards: nearly 70% of vulnerability cases culminate in intrusions, and 68% of those incidents end in the deployment of malicious code, against 23% for phishing.

Two different datasets, one implication. An exploited vulnerability converts into a real intrusion far more reliably than a phish does, but these observational datasets do not establish a universal causal conversion rate for your environment.

What actually gets exploited, and how fast

Mandiant analysed 138 vulnerabilities disclosed in 2023 that it tracked as exploited in the wild – 97 zero-days and 41 n-days. The average time-to-exploit was five days, and that figure is outlier-adjusted: 15 outliers, 13 zero-days and two n-days, were removed by a standard-deviation analysis. Without their removal the average grows from five to 47.

The trend behind it is why patch windows written in 2019 no longer hold. Average time-to-exploit fell from 63 days in 2018–2019 to 44 days in 2020–early 2021, then 32 days in 2021–2022, then five days in 2023. Exploits were also the number one initial infection vector in Mandiant’s incident response engagements in 2020, 2021, 2022 and 2023.

For n-days – the ones a patch process can actually influence – the distribution is the part to plan against:

How fast 2023 n-day vulnerabilities were exploited

Time from disclosure	Share of the 41 n-days exploited
Within one day	12% (5)
Within one week	29% (12)
Within one month	56%
Within six months	95% – all but two of the 41

The five inputs

Everything below routes on five facts. Three come from public data and two only you can supply – which is why a tool alone never finishes the job.

• KEV – is the CVE in CISA’s Known Exploited Vulnerabilities catalog?
• EPSS – what is its probability of exploitation being observed in the next 30 days?
• CVSS – how severe is the impact if it is exploited?
• Exposure – is the affected asset publicly exposed or otherwise attacker-reachable?
• Asset value – what are the system and its data worth to the business?

The routing table

Tiers are cheap to define and expensive to get wrong, so tie each one to a trigger you can query and a clock you can measure. The thresholds here follow FIRST’s effort translation: the cited snapshot places EPSS ≥0.04 near the 90th percentile, and it selects a population comparable in size to CVSS Critical.

Routing a finding to a tier

Tier	Trigger	Action	Clock
1 – Act now	Confirmed affected instance listed in KEV, or EPSS ≥0.04 with public exposure	Prioritise the vendor fix or an effective mitigation; consider isolation where necessary	Same day
2 – This week	EPSS ≥0.04 on a reachable internal asset, or CVSS Critical with confirmed presence	Schedule into the next change window and verify the fix	Days
3 – Planned	No higher-tier trigger; lower forecast and limited reachability, subject to impact and policy	Routine patch cycle	Next scheduled cycle
4 – Monitor	Verified non-applicability, or a documented effective mitigation with accepted residual risk	Record evidence and the responsible owner; re-triage when conditions change	Continuous

If you want an external reference point for the top tier, BOD 26-04 sets a three-day patching deadline for US federal agencies where a publicly exposed asset carries an automatable vulnerability with total technical impact – and pairs it with a forensic triage of that asset.

A worked example

Take a scanner dump of 10,000 findings. Sorted by CVSS you keep about half of it, because High and above is approximately the top 48% of published vulnerabilities; narrow to Critical alone and you keep just over 10%. A scanner dump need not resemble the published CVE population: products, duplicate findings and local configuration change the distribution. Treat these percentages as an illustration and measure the actual queue.

Now overlay threat data. An EPSS ≥0.04 filter selects a comparable-sized population, but one chosen by likelihood of exploitation rather than intrinsic severity: the same effort, spent on a better-chosen set. Then overlay KEV, which holds 1,709 entries in total against roughly 61,000 CVEs published in the last 12 months. Cross-referenced against one asset inventory, KEV usually resolves to a handful of CVEs – and those are where you start.

Finally cut by presence and exposure. What survives is short enough to carry owners and dates, which is the only real test of a prioritisation process. The triage tool runs a single finding through the same five inputs if you want to sanity-check a tier.

A public PoC is a signal, not proof of attack

The most expensive habit in triage is escalating on publicity. Mandiant found that of the vulnerabilities disclosed in 2023 that received media coverage, 58% are not known to be exploited in the wild, and among those with at least one public proof of concept or exploit, 72% are not known to be exploited in the wild.

It found no relationship in the timing either: exploit release and media attention are not predictive of exploitation timelines. A branded logo and a GitHub PoC will reorder your week if you let them, whereas KEV and EPSS will not, because they distinguish confirmed exploitation from a modelled probability – a distinction our CVSS vs EPSS guide unpacks in full.

Exposure is the multiplier

The 2026 DBIR makes the point through ransomware victims, who are overwhelmingly small and mid-sized – about 96% of the ransomware victims whose size it could determine were SMBs. Those attacks turned on compromised credentials (38%) or unpatched vulnerabilities in edge devices (29%): assets with no agent, no convenient maintenance window and a public IP address.

The remediation record is getting worse, not better. Across more than 13,000 organisations, only 26% of the CISA KEV vulnerabilities found in their environments were fully remediated – down from 38% the year before – and the median time to full remediation rose to 43 days from 32. The same report also observed a larger backlog: the median organisation had 16 KEV vulnerabilities to patch in 2025 against 11 in 2024. The 43-day remediation median and the separate five-day exploitation mean concern different datasets and cannot be subtracted into a precise exposure window. They support examining both remediation delay and exploitation evidence; exposure, impact and binding obligations should shape the queue.

Common mistakes

• Sorting purely by CVSS. High and above is roughly half of everything published, so the sort barely narrows the list.
• Blending scores. Multiplying EPSS by CVSS produces a number with no interpretable meaning, and hides both inputs.
• Ignoring exposure. A Critical on an isolated internal host rarely outranks a lesser flaw on an internet-facing gateway.
• Triaging quarterly. EPSS is recomputed daily, and KEV added roughly five entries a week through 2025.
• Never validating – assuming a “critical” CVE is exploitable in your environment without ever testing it.

Prove it with testing

Scores and testing answer different questions. A penetration test or attack-surface assessment can demonstrate exploitation paths in scope and provide evidence about existing controls. A test that does not reproduce an exploit is not by itself proof that exploitation is impossible. Other valid outcomes include verified non-applicability, a documented effective mitigation, or explicit risk acceptance by the responsible owner. Testing is one source of evidence, not the only basis for closing a finding.

One caveat on the top tier. Where an asset was publicly exposed, the flaw was automatable and exploitation would have handed over total control, the question is forensic rather than administrative – that is precisely why BOD 26-04 attaches a triage of the asset to its three-day deadline, rather than treating the patch as the end of the incident.