- 01Vulnerability management by CVSS alone produces a backlog too large to ever close and prioritizes wrong. Modern prioritization combines EPSS (probability of exploitation), CISA KEV (known exploited), and reachability (does the vulnerable code run on internet-exposed paths?) to focus effort.
- 02Triage matrix: KEV + reachable + critical-asset → patch within 48 hours; high EPSS + reachable → patch within 7-14 days; high EPSS + not reachable → fix in normal release cadence; low EPSS + not reachable → batch in maintenance windows; track exception lifecycle separately for all categories.
- 03Reachability as the multiplier: most CVSS-9.8 vulnerabilities in your codebase do not run in production code paths. Reachability analysis (modern SCA, CNAPP, runtime sensors) cuts the actionable list by an order of magnitude. Without it, the team is patching the universe.
- 04Compensating controls: when patching is delayed (operational constraints, vendor unavailability), explicit compensating controls (WAF rules, network segmentation changes, runtime protection) should be documented with the same rigor as the patch itself. Track them to close when the patch ships.
Vulnerability management by CVSS alone produces a backlog that is too large to ever close and prioritizes wrong. Modern prioritization uses EPSS (probability of exploitation), CISA KEV (known exploited), and reachability (does the vulnerable code run on internet-exposed paths?) to focus effort.
The triage matrix
- 01KEV + reachable + critical-asset → patch within 48 hours
- 02High EPSS + reachable → patch within 7-14 days
- 03High EPSS + not reachable → fix in normal release cadence
- 04Low EPSS + not reachable → batch in maintenance windows
- 05All categories — track exception lifecycle separately
Reachability as the multiplier
Most CVSS-9.8 vulnerabilities in your codebase do not run in your production code paths. Reachability analysis (provided by modern SCA tools, CNAPP, or runtime sensors) cuts the actionable list by an order of magnitude. Without reachability data, the team is patching the universe.
Compensating controls
When patching is delayed (operational constraints, vendor unavailability), explicit compensating controls — WAF rules, network segmentation changes, runtime protection — should be documented with the same rigor as the patch itself. Track them to close when the patch ships.