Route by three facts: is it being exploited, is it reachable in something you run, and does someone own the fix. Exploited, exposed and owned means page. Exposed or owned means ticket. Everything else goes to a digest. This keeps interruptions rare and meaningful.
The three tiers
A page is an immediate interruption with a defined response time. A ticket is a tracked work item with an owner and a due date. A digest is a periodic summary read on a schedule, with no individual notification.
The decision table
| Exploited in the wild | Reachable or deployed | Named owner | Route |
|---|---|---|---|
| Yes | Yes | Yes | Page |
| Yes | Yes | No | Page the on-call, assign owner today |
| Yes | No | Any | Ticket, short due date |
| No | Yes | Yes | Ticket |
| No | Yes | No | Ticket, assign owner in triage |
| No | No | Any | Digest |
For the first column, the CISA KEV catalog is a public, maintained list of vulnerabilities with confirmed exploitation. FIRST describes EPSS as an estimate of the probability of exploitation in the next 30 days, updated daily. KEV is evidence of exploitation. EPSS is a forecast. Use them differently.
Set response times per tier
Write them down, or the tiers are only labels.
- Page: acknowledge within the on-call window you already use for outages.
- Ticket: first action within a few working days, with a due date based on severity.
- Digest: read weekly, with decisions recorded.
Keep the numbers modest and honest. A promise you cannot keep is worse than none.
Handle promotion and demotion
Tiers are not permanent. A digest item can be promoted when it is added to KEV or when an exploit appears. A page can be demoted once a mitigation is in place. Automate promotion where you can, and review demotions by hand so nothing is quietly downgraded.
Test the routing
Replay last month's findings through the table. Count how many would have paged. If the number is more than a person can bear, tighten the first row. If a real incident would have landed in the digest, loosen it.
Related reading: build an alert ownership map.
Where Safeguard fits
Safeguard's policies let you express rules such as blocking only when a finding is reachable, and reachability analysis supplies the second column of the table. A free scan shows how findings look for your project.
Try it yourself
Click through it at your own pace, or open it full screen.
Check how exploitability changes which finding you would act on first.
Quick check
Should a high CVSS score alone trigger a page?
Usually not. Severity says how bad it could be, not whether it is exploited or reachable in your setup.
What if nobody owns a service?
Assign an owner in triage. A finding with no owner will sit in any tier.
Sources
Last reviewed: 19 October 2026.
