vulnerability prioritization Shipped
What this lens looks for
Order remediation by exploitability, not raw CVSS. Evaluate each finding in priority order: (1) CISA KEV catalog = fix-now, reachable KEV ahead of all non-KEV; (2) EPSS probability (top decile ~ >=0.1, record score + percentile); (3) reachability/call-graph (deprioritize unreached transitive CVEs, but record rationale — unreachable != ignored); (4) CVSS as tie-breaker only. Automate the scoring in CI; pin the EPSS model version; weight supply-chain/build-tooling findings (OWASP 2025 A03).
What its verifier checks
Remediation queue ordered by KEV -> high-EPSS -> reachability -> CVSS-tiebreak, never by CVSS severity alone; reachable KEV CVEs fixed ahead of all non-KEV; EPSS raw score and percentile recorded with the chosen threshold; unreachable transitive CVEs deprioritized with a documented note and re-check trigger, not silently ignored; KEV-listed low-CVSS CVEs not skipped; the EPSS threshold records the model version (v4, 2025-03-17) it was tuned against; scoring automated in CI so the gate is deterministic.