cvechain
Try the triage tool

How to prioritise vulnerabilities: a practical playbook

Updated 2026-07-05 2 min read

With 40,000+ new CVEs a year, prioritisation – not patching speed – is the real bottleneck. This is a practical, tool-agnostic way to turn a scanner dump into a short, defensible action list.

Start from the attacker’s view

Attackers don’t sort vulnerabilities by CVSS. They use exploits that work, against systems they can reach. A good prioritisation process mirrors that: it favours confirmed exploitation and exposure over abstract severity.

The five inputs

  • KEV – is the CVE in CISA’s Known Exploited Vulnerabilities catalog?
  • EPSS – what is its probability of exploitation in the next 30 days?
  • CVSS – how severe is the impact if exploited?
  • Exposure – is the affected asset internet-facing or attacker-reachable?
  • Asset value – how critical is the system and its data to the business?

The playbook

  1. Tier 1 – Act now: anything in KEV, or high EPSS on an exposed asset. Patch or mitigate immediately.
  2. Tier 2 – This week: high EPSS or Critical CVSS on a reachable asset that isn’t yet confirmed exploited.
  3. Tier 3 – Planned: high CVSS but low EPSS and no exposure. Handle in normal patch cycles.
  4. Tier 4 – Monitor: low probability and not reachable. Track and re-triage as scores change.

Common mistakes

  • Sorting purely by CVSS – most CVEs are High/Critical, so it barely narrows anything.
  • Ignoring exposure – a Critical flaw on an isolated internal box rarely beats a lesser one on a public gateway.
  • Treating prioritisation as quarterly – the exploited set changes constantly.
  • Never validating – assuming a "critical" CVE is exploitable in your environment without testing it.

Prove it with testing

Scores predict; testing confirms. A penetration test or attack-surface assessment shows which vulnerabilities are actually exploitable in your environment and which are shielded by existing controls – closing the gap between a theoretical list and real risk.

FAQ

Related questions

What is risk-based vulnerability management?

An approach that ranks vulnerabilities by the actual risk they pose – combining exploitation (KEV), probability (EPSS), severity (CVSS) and exposure – rather than patching strictly by CVSS score.

How many vulnerabilities should end up in the "act now" tier?

Far fewer than your scanner’s "critical" count. Because only a small fraction of CVEs are exploited, filtering by KEV and EPSS on exposed assets typically produces a short, actionable list.

Do I still need to patch low-priority vulnerabilities?

Yes – eventually. Prioritisation decides order and urgency, not whether to fix. Low-tier items are handled through routine patch cycles and re-checked as their scores change.

Keep reading

More guides