CVSS measures severity, EPSS estimates exploitation probability, the KEV catalog lists vulnerabilities known to be exploited, and SSVC is a decision method that combines several factors. None answers the whole question alone. When you compare tools, check which of these they use and whether you can see the inputs.
CVSS: how bad could it be
The CVSS guide describes it as a framework for communicating the characteristics and severity of vulnerabilities, and states that base scores measure severity, not risk. It also says base scores should be supplemented with environment and threat information. A tool that shows only the base score is showing you one input.
EPSS: how likely is exploitation
FIRST describes EPSS as estimating the probability that a published CVE will be exploited in the wild in the next 30 days, with a score from 0 to 1 published daily. It says nothing about the impact on your systems. Our post on EPSS probability and percentile explains which number to read.
KEV: it has already happened
CISA calls the Known Exploited Vulnerabilities catalog an authoritative source of vulnerabilities exploited in the wild, and says organizations should use it as an input to their prioritization framework. It is short and precise but, by design, backward looking.
SSVC: a decision, not a score
SSVC, developed by Carnegie Mellon's SEI with CISA, uses decision points such as exploitation status, technical impact, automatable, mission prevalence and public well-being impact, and ends in outcomes named Track, Track*, Attend or Act. It needs inputs about your own context, so a vendor can only apply it fully if you supply them.
What to ask a vendor
Which of these four do you ingest, and how often is each refreshed? Can I see each input next to the final rank? Can I change the weighting? What do you add that none of these cover, for instance reachability or asset exposure?
A fair comparison
Give each tool the same fifty findings and compare the top ten against a ranking your engineers agree on. The tool that explains its order is easier to trust than the one that matches it by luck.
Where Safeguard fits
Safeguard covers SBOM and dependency scanning, reachability analysis, policies and gates, and fix pull requests that stay off until you turn them on. You can try a free scan on a repository before you commit to anything.
Try it yourself
Click through the exploitability check and see how a severity score changes meaning once exploitation evidence is added.
Click through it at your own pace, or open it full screen.
Quick check
Is CVSS useless then?
No. It is a useful severity input. It just should not stand alone.
Which single signal should I rely on?
None on its own. They answer different questions, so combine them.
Sources
- FIRST, CVSS v4.0 User Guide
- FIRST, Exploit Prediction Scoring System (EPSS)
- CISA, Known Exploited Vulnerabilities Catalog
- CISA, Stakeholder-Specific Vulnerability Categorization (SSVC)
Last reviewed: 19 October 2026.
