Present prioritization as a funnel: total open findings at the top, then the subset with confirmed exploitation, then the subset with higher exploit probability, then the subset your code can reach. Each layer answers a different question, and the report shows how many findings survive each one.
What each filter answers
- KEV listing: is there reliable evidence that attackers are using this vulnerability? CISA adds entries on that basis.
- EPSS: how likely is exploitation activity in the next 30 days? FIRST describes it as a probability from 0 to 1, updated daily.
- Reachability: can your code call the vulnerable function?
- Exposure: is the asset reachable from the internet or an untrusted network?
These are not interchangeable. KEV is evidence of past and present use. EPSS is a forecast. Reachability and exposure describe your environment.
Reading EPSS correctly
The EPSS FAQ explains several points that trip readers up. Most scores sit near zero because exploitation has a low base rate. The FAQ notes that a score of 0.05 can already sit in the top ten percent of published vulnerabilities. It also says EPSS is not a complete risk score, since it does not know your environment. And it warns that multiplying EPSS by a CVSS score has no interpretable meaning.
So do not average or multiply the layers. Keep them as separate filters.
Build the funnel
- Take open findings with asset and CVE.
- Count the total.
- Flag KEV matches and count them. These go to the front of the queue.
- For the rest, apply your chosen EPSS threshold and count.
- Of those, count the reachable and the internet-facing.
- Show all four counts and the trend.
| Layer | Count to show |
|---|---|
| All open | Total |
| Known exploited | Always prioritized |
| Higher EPSS, not KEV | Watch list with a threshold you choose |
| Reachable and exposed | Where fixes begin |
The EPSS threshold is your decision. Record it, review it, and note that scores change daily, so the same finding can move across the line.
Common mistakes
- Dropping findings that fail every filter. Keep them tracked, with lower priority.
- Using a snapshot EPSS value forever. Refresh it.
- Calling the funnel a risk score. It is a prioritization aid.
- Hiding missing data. If reachability was not analyzed, show that bucket.
Executive view
Give the four counts and one sentence on what is being fixed first. Leaders do not need the formulas, but they need to trust that the ordering has a reason.
Where Safeguard fits
Safeguard can help with the inputs behind this. It runs SBOM and dependency scanning, reachability analysis to separate reachable findings from the rest, and policies and gates that you set. You can try a free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Step through an exploitability check and note which signals move a finding up or down.
Quick check
Should every KEV item outrank everything else?
As a default, yes, since exploitation is confirmed. If a KEV item is on an asset you have verified is not affected, document that and move on.
Can we skip EPSS and use only KEV?
You can start there. EPSS adds a forecast for vulnerabilities not yet listed, but it is optional and should not replace KEV.
Sources
Last reviewed: 19 October 2026.
