Enrichment attaches extra facts to a raw match: a severity score, a weakness category, an exploit probability, a flag for known exploitation, and the fix version. A match says only that a version is listed in an advisory. Enrichment says how serious it might be and what to do, using data from several public sources.
The fields and where they come from
| Field | What it tells you | Typical source | Limit |
|---|---|---|---|
| Severity (CVSS) | Intrinsic seriousness | Maintainer or public database | Often Base only, no context |
| Weakness type (CWE) | The class of flaw | Advisory or database | Sometimes missing or broad |
| Exploit probability (EPSS) | Chance of exploitation within 30 days | FIRST, updated daily | A probability, not a verdict |
| Known exploitation (KEV) | Evidence it is exploited now | CISA catalog | Covers a subset of all CVEs |
| Fix version | Where the issue is closed | Advisory ranges | May not exist yet |
| References | Patches, write-ups, vendor notes | Advisory | Quality varies |
How to read the exploit fields
EPSS is a data-driven model that estimates the probability a vulnerability will be exploited in the wild within the next 30 days. It gives a score from 0 to 1 for every published CVE and updates daily. FIRST states plainly that EPSS has no insight into your context, so a full risk view needs environmental detail and impact as well.
The CISA Known Exploited Vulnerabilities catalog is different in kind. It is a list, with each entry carrying a date added, a due date and a required action. An entry also records whether it is known to be used in ransomware campaigns. Being listed is a strong signal that the issue should move up.
Together they behave like this: a high EPSS with no KEV listing means likely but unconfirmed; a KEV listing means confirmed regardless of the probability.
Where enrichment goes wrong
- Staleness. Daily data that is a week old is not daily data. Check when each field was last refreshed.
- Missing data. Newly published CVEs may lack scores for a while. Treat blank as unknown, not as zero.
- Silent overrides. A tool may replace the publisher's score with its own. Prefer tools that show both.
- Mixing up signals. Severity says how bad it could be. EPSS and KEV say how likely and how real. Do not collapse them into one label without saying so.
A simple enriched finding
component: example-lib 2.3.1
advisory: GHSA-xxxx (alias CVE-yyyy)
severity: CVSS-B 8.1 (v3.1, source: public database)
exploit: EPSS 0.12, not in KEV
fix: 2.3.4
From that, a developer can act, and a reviewer can decide the order.
Where Safeguard fits
Safeguard enriches findings and adds reachability analysis, then lets policies and gates act on the combined result. If you want to see how the fields look on your own code, use the free scan.
Quick check
If a CVE is not in KEV, is it safe to ignore?
No. KEV lists confirmed exploitation, not every dangerous flaw. Use it as one signal beside severity, probability and your own context.
Does a low EPSS score mean low risk?
It means exploitation looks less likely in the next 30 days. Impact on your system still matters, because EPSS does not know your environment.
Sources
Last reviewed: 19 October 2026.
