Many beliefs people form from security headlines are only partly true. A critical score does not always mean urgent, a catalog entry is strong evidence rather than the whole picture, and silence from a vendor is not proof of safety. Here are seven myths and what the primary sources support.
Myth 1: A high CVSS score means drop everything
Fact: the CVSS specification describes the base score as the intrinsic severity of a flaw, constant across environments. It also offers threat and environmental metrics to adjust for exploitation and your setup, and says wider factors such as customer impact are outside its scope. Use the score as one input.
Myth 2: A low score means safe to ignore
Fact: a low scored flaw can still be exploited, and a flaw that is in a known exploited catalog deserves attention whatever its number. Check exploitation evidence as well as severity.
Myth 3: EPSS is a risk score
Fact: the FIRST FAQ describes EPSS as the probability of exploitation in the next 30 days, covering only the likelihood part of risk, and warns that multiplying it by a CVSS score does not compute probability times severity.
Myth 4: If it is not in the CISA catalog, nobody is exploiting it
Fact: the catalog lists vulnerabilities that have been added after evidence of exploitation. It is described by CISA as an input to prioritisation. Absence from it means not yet listed.
Myth 5: The date of the news is the date of the breach
Fact: reports often involve three different dates: intrusion, discovery and disclosure. For SEC registrants, the four business day filing clock under Item 1.05 starts at the materiality determination, so a filing can follow the intrusion by a long way.
Myth 6: A researcher publishing details means the vendor ignored it
Fact: publication often follows a stated deadline. Project Zero's policy, for instance, publishes 30 days after a patch, or at 90 days without one, so details can appear on schedule rather than from neglect. Policies vary, so read each post's timeline.
Myth 7: Our scanner showed nothing, so the news does not apply
Fact: a scanner knows what it can see. New flaws take time to reach its database, and software it does not inventory is invisible to it. Check the specific product and version yourself when the story is serious.
How to use this list
When you catch yourself holding one of these beliefs, find the primary source and read the exact wording. That small habit does more for calm decision making than any tool.
Quick check
Which myth causes the most wasted work?
Treating a headline score as the priority. It sends teams after items that do not apply while missing quiet ones that do.
Where can I read the original wording?
The CVSS specification, the EPSS FAQ and the CISA catalog page are public. The Sources list below links to each.
Sources
- FIRST, CVSS specification document
- FIRST, EPSS frequently asked questions
- CISA, Known Exploited Vulnerabilities Catalog
- SEC press release 2023-139, cybersecurity disclosure rules
- Project Zero, vulnerability disclosure policy
Last reviewed: 19 October 2026.
