KEV tells you a vulnerability is known to be exploited in the wild. EPSS estimates the probability that a CVE will be exploited in the next 30 days. Use KEV as a hard override, EPSS as a sort key inside a severity band, and your service exposure as the final tie breaker.
Definitions
CISA describes the Known Exploited Vulnerabilities catalog as its authoritative source of vulnerabilities that have been exploited in the wild. A listing is a fact about the past and present, not a prediction.
FIRST describes EPSS, the Exploit Prediction Scoring System, as a data driven machine learning model that estimates the probability a published CVE will be exploited. The score is a value from 0 to 1 for the following 30 days, with a percentile alongside, and it is updated every day for every CVE.
They answer different questions. KEV: is it being used right now. EPSS: how likely is it soon.
A ranking recipe
- Start with all open findings and attach the service, tier and exposure.
- Pull any CVE on the KEV list to the top. These go first, in every tier.
- For the rest, group by severity band.
- Inside each band, sort by EPSS, highest first.
- Within equal EPSS, put internet facing services before internal.
- Push reachable findings above unreachable ones where you have reachability data.
What the table looks like
| Signal | Role | Weakness |
|---|---|---|
| KEV listing | Override | Does not list everything that will be exploited |
| EPSS | Sort inside bands | A probability, not a verdict |
| Severity score | Coarse band | Ignores your context |
| Exposure and tier | Tie breaker | Needs a good inventory |
| Reachability | Demote or promote | Needs analysis support |
Common mistakes
Do not treat a low EPSS as safe. It is an estimate, and a new proof of concept can change it, which is why it is refreshed daily. Do not ignore severity entirely either, since a flaw with serious impact can matter even at low likelihood in a tier 1 service.
Do not rank per service only. The fleet view lets you see that one CVE affects fifty services and deserves a campaign.
Reviewing the ranking
Re-run the ranking daily, since both inputs change. Save the top ten each week. If the same items stay on top for a month, the problem is not the ranking, it is the fix capacity or ownership.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how exploit signals change what you would fix first.
Quick check
Does a CVE need to be on KEV to be urgent?
No. KEV is a strong signal, but exposure, impact and EPSS can all make something urgent.
How often does EPSS change?
FIRST says it updates every day for every CVE.
Safeguard's vulnerability management and reachability analysis support this kind of prioritisation, and you can run a free scan.
Sources
Last reviewed: 19 October 2026.
