/vulnerability-prioritization

name: vulnerability-prioritization
description: >-
  Rank a set of vulnerabilities by real-world risk using CVSS (severity), EPSS
  (exploit probability), CISA KEV (known exploited), and asset/exposure context —
  so remediation effort goes to what actually matters first. Use when a triaged
  finding list needs a defensible "fix this first" order.

Goal

A risk-ranked, defensible remediation order — not just "sort by CVSS" — that a team can act on and an auditor can understand.

The signals (combine, don't rely on one)

• **CVSS base** — technical severity / worst-case impact. A ceiling, not a priority.
• **EPSS** — probability the CVE is exploited in the wild in the next 30 days. Cuts

the long tail of high-CVSS-but-never-exploited bugs.

• **CISA KEV** — on the Known Exploited Vulnerabilities catalog ⇒ treat as top

priority regardless of CVSS; active exploitation is confirmed.

• **Asset context** — criticality, internet exposure, data sensitivity, and

compensating controls. An internal, segmented, low-value host changes the math.

• **Exploit maturity / threat intel** — public PoC, weaponized, ransomware use

(pair with `threat-intelligence`).

Steps

1. Pull CVSS, current EPSS score, and KEV membership for each CVE. 2. Apply a tiering rule, in order:

• **P1 / now:** on CISA KEV, or (internet-exposed AND high EPSS AND high impact).
• **P2 / SLA-fast:** high EPSS or critical CVSS on important assets.
• **P3 / scheduled:** everything else, ranked by EPSS then CVSS.
• **P4 / accept or defer:** low impact, low EPSS, well-mitigated, non-prod.

3. Adjust for asset context (exposure, criticality, compensating controls) — document every up/down adjustment so the ranking is auditable. 4. Map each tier to a remediation **SLA** and route to `remediation-tracking`.

Output

A ranked list with, per item: identifier · CVSS · EPSS · KEV(y/n) · asset context · assigned tier · SLA · one-line justification. Note any risk-accepted items with owner and review date.

Notes

CVSS alone over-prioritizes: most high-CVSS CVEs are never exploited. EPSS + KEV is what separates theoretical from real risk. KEV is non-negotiable — if it's being exploited in the wild, severity score is irrelevant. Re-score periodically: EPSS and KEV change over time, so today's P3 can become tomorrow's P1.