How to prioritize external exposures with CVSS, EPSS, KEV and exploit validation

Why is a severity score not enough on its own?

FIRST, which maintains the Common Vulnerability Scoring System, describes CVSS as a way to capture the principal characteristics of a vulnerability and produce a numerical score reflecting its severity. Severity is a property of the flaw. It does not say whether anyone is exploiting it, whether your copy of the software is reachable from the internet, or whether a control in front of it already blocks the attack.

Volume makes the gap wider. In February 2026 FIRST forecast a median of about 59,427 CVEs for the year, and in June it raised the forecast to about 66,000. An external attack surface of a few thousand hosts will match a large number of those CVEs by version string alone. Sorting that list by CVSS produces a long queue of critical items, and most of them will never be exploited against you.

What does each signal tell you?

In what order should you work the list?

1. Confirm the asset is yours and has an owner. A finding on an asset that belongs to a divested unit or a supplier goes to a different queue. This is why attribution is a separate criterion in our score matrix.
2. Put validated exposures first. If your ASM tool has safely proven that an exposure can be exploited on a specific host, that finding outranks any score. Our validation criterion carries 15% of the weighted score; watchTowr and Hadrian score 9 on it, IONIX and CyCognito 8.
3. Then work KEV matches on internet-facing assets. CISA adds a vulnerability to the catalog when it has a CVE ID, there is reliable evidence of active exploitation, and there is a clear remediation action. Federal civilian agencies must remediate KEV entries within set timeframes under Binding Operational Directive 22-01, and CISA recommends that other organizations include a requirement to immediately address KEV catalog vulnerabilities in their vulnerability management plan.
4. Then high EPSS probabilities. EPSS estimates the probability that a published CVE will be exploited in the wild in the next 30 days, and FIRST publishes the scores daily, free, as CSV and through an API. Pick a threshold your team can clear each week and review it every quarter.
5. Use CVSS to order what remains, and to set a maximum age for anything left open.
6. Inside each band, sort by business context: the sensitivity of the data, whether the asset faces customers, and how many other systems depend on it.

What should you do when a fix cannot ship this week?

A validated or KEV-listed exposure on an application that cannot be patched quickly needs a compensating control, most often a WAF rule that blocks the exploit path while the patch waits. Several tools in our ranking document this. IONIX states it can produce a deployable WAF rule within 12 hours of a CVE's publication, watchTowr pushes Active Defense rules to edge platforms, and Cortex Xpanse runs Active Response playbooks through Cortex XSOAR.

Record the control against the finding and keep the finding open until the patch lands and a retest confirms it. Our note on virtual patching covers the approvals to put around automated rules.

How do you check whether a tool supports this order of work?

Ask each vendor to show, on your own estate:

• which EPSS and KEV data it uses, and how often it refreshes them;
• how it proves exploitability, and what traffic that test sends;
• whether a finding arrives with an owner, guidance and a ticket;
• whether it retests after a fix.

Our findings table records which of these each vendor documents publicly. Censys ASM, for example, documents EPSS and KEV scoring with reachability confirmation, and CyCognito documents a retest after remediation.

What should a weekly review show?

Four numbers fit on one page: validated exposures still open, KEV matches still open on internet-facing assets, the age of the oldest item in each of those two bands, and how many items were closed by a patch versus by a compensating control. Together they show whether the program is reducing exposure or producing a longer list.