Each signal answers a different question. The CISA KEV catalog says a vulnerability is known to be exploited. EPSS estimates the chance of exploitation in the next 30 days. CVSS rates technical severity. SSVC turns several factors into a decision such as track or act. Use them together.
One question per signal
| Signal | Question it answers | Type of output |
|---|---|---|
| CISA KEV | Is it known to be exploited in the wild? | Yes or no list |
| EPSS | How likely is exploitation soon? | Probability, zero to one, with percentile |
| CVSS | How severe is the flaw in general? | Score from zero to ten |
| SSVC | What should we do about it? | Decision: Track, Track star, Attend, Act |
Mixing up the questions leads to mistakes. A CVSS score cannot tell you whether anyone is attacking. A KEV entry cannot tell you whether the vulnerable code runs in your product.
What the sources say
CISA describes the KEV catalog as the authoritative source of vulnerabilities exploited in the wild and advises using it as an input to a vulnerability management prioritization framework.
FIRST describes EPSS as an estimate of the probability that a published CVE will be exploited in the wild in the next 30 days, published daily as a 0 to 1 probability with ranking percentiles.
FIRST also states that a CVSS Base score measures severity and should not be used alone to assess risk.
CISA's SSVC decision tree considers exploitation status, technical impact, whether exploitation is automatable, mission prevalence and public well being impact. Its outcomes are Track, Track star, Attend and Act, where higher outcomes imply faster remediation and involvement of more senior staff.
Which one goes in which report
- Engineers: KEV flag, fixed version, reachability, due date. Keep EPSS and CVSS as sort fields.
- Managers: counts of items by decision tier, past SLA, with KEV items called out.
- Executives: one line on KEV exposure and one on the oldest priority item. Avoid probabilities unless asked, and explain them if shown.
Steps to combine them
- Start with KEV: any reachable KEV item gets the top tier.
- For the rest, sort by EPSS within severity bands.
- Use reachability and system criticality to move items up or down.
- Record the final tier and a short reason.
- Report counts by tier.
You do not need all four to start. KEV plus reachability already removes a lot of noise. Add the rest as the process matures.
Cautions
- EPSS is a probability, not a certainty. A low value does not mean never
- A KEV listing is evidence of exploitation somewhere, not necessarily against your configuration
- Do not publish a combined score you cannot explain in a sentence
For an approach to a very large backlog, see prioritizing a large finding backlog.
Safeguard's reachability analysis and policies can combine exploitation signals with whether code is reachable, and you can test your own repository with a free scan.
Try it yourself
Click through it at your own pace, or open it full screen.
See how many findings remain once reachability is applied, and think about where the other signals would reorder them.
Quick check
If a CVE is not in KEV, can I ignore it?
No. KEV lists only items with evidence of exploitation that meet its criteria. Many serious flaws are not listed.
Which single signal should a small team start with?
Start with KEV, since it is a short, factual list, then add reachability.
Sources
- CISA, Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- FIRST, EPSS: https://www.first.org/epss/
- FIRST, CVSS v4.0 user guide: https://www.first.org/cvss/v4-0/user-guide
- CISA, SSVC: https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc
Last reviewed: 19 October 2026.
