Match your SBOM components to advisories, then rank the matches by evidence of real exploitation: first anything in CISA's Known Exploited Vulnerabilities catalog, then higher EPSS probabilities, then your own exposure. The result is a short list your team can finish, not a long one sorted by severity.
Why severity alone is a weak sort
A severity score describes how bad a flaw could be. It does not say whether anyone is using it. Large SBOMs produce hundreds of matches, and sorting by severity gives you a list far too long to clear. Exploitation evidence cuts it down.
The two signals
KEV. CISA maintains a Known Exploited Vulnerabilities Catalog that you can search and filter by CVE, vendor and date added. If a CVE in your SBOM matches an entry, treat it as first in line.
EPSS. The Exploit Prediction Scoring System is a data driven model that estimates the probability that a published CVE will be exploited in the wild in the next 30 days. It publishes a probability from 0 to 1, with percentiles, every day for every CVE, and the data is free via CSV and API. FIRST says it helps you focus limited remediation effort where attacks are most likely.
Neither signal knows your environment. That is the third step.
Steps
- Match each SBOM component and version to advisories.
- Flag KEV matches. These go to the top.
- Add EPSS to the rest and sort by probability.
- Check reachability and exposure. Is the vulnerable code called? Is the service internet facing? Is a fix available?
- Set the cut. Choose a threshold your team can clear in a sprint, and write it down.
- Re-run daily or weekly, because both sources change.
A sample ordering
| Tier | Condition | Typical handling |
|---|---|---|
| 1 | In KEV, reachable, exposed | Fix now |
| 2 | In KEV, not reachable or not exposed | Fix soon, document why |
| 3 | High EPSS, reachable | Next sprint |
| 4 | Everything else | Normal upgrade cycle |
Treat this as a template, since your risk tolerance and regulatory duties set the real timelines. Some regulators and customers set their own deadlines for known exploited flaws, so check yours.
Pitfalls
- EPSS is a probability about a window of time, not a promise. A low score is not safe.
- A flaw can be exploited and still be absent from KEV.
- Matching depends on accurate versions in the SBOM. Garbage in, garbage out.
For a related decision aid, see from inventory to insight.
Try it yourself
Click through it at your own pace, or open it full screen. Look at which signals move a finding up or down.
Safeguard's dependency scanning and reachability analysis help narrow SBOM matches to the ones that matter. You can try a free scan.
Quick check
Is EPSS the same as severity?
No. Severity describes potential impact. EPSS estimates likelihood of exploitation in the next 30 days.
Do I still need reachability if I have KEV and EPSS?
Yes. They describe the flaw in general. Reachability and exposure describe your system.
Sources
Last reviewed: 19 October 2026.
