An exception should end before its expiry date when the facts it rested on change. Good triggers are a new exploitation signal, such as a listing in the CISA KEV catalog, a jump in exploit probability, a change in exposure, a failed compensating control, or a fix becoming available at low cost.
Why an end date is not enough
An exception is a bet that a risk stays small for a set period. If the bet goes wrong in week two, waiting until week twelve is a decision nobody made. Revocation triggers turn "review at expiry" into "review when it matters."
Five triggers
- Exploited in the wild. CISA maintains the Known Exploited Vulnerabilities catalog and says it is "the authoritative source of vulnerabilities that have been exploited in the wild." CISA also advises organizations to use it as an input to their prioritization. A KEV listing for an accepted CVE should reopen the case at once.
- Exploit probability rises. FIRST's EPSS estimates "the probability a vulnerability will be exploited in the wild within the next 30 days," recalculated daily. It is not a complete risk score, so use a jump as a prompt to re-review, not as proof.
- Exposure changes. A service moves from internal to internet-facing, a firewall rule changes, or a new integration opens a path. The exception was approved for a different asset.
- A compensating control fails. A WAF rule is removed, a network segment is merged, a feature flag is turned back on. The exception names the control, so the control's health is part of the exception.
- A cheap fix appears. A patched version ships, or an automated fix pull request becomes available. The cost side of the decision changed. Read accepting a vulnerability when a fix PR exists.
What revocation does
| Step | Result |
|---|---|
| Status flips to open | The finding counts against gates and SLAs again |
| Owner notified | The requester and approver get the reason |
| Clock restarts or resumes | Decide in the policy, and keep the rule fixed |
| Record kept | The earlier decision and the revocation both stay in the audit trail |
Do not delete the exception. The history shows that the control worked.
Make it automatic
Revocation by memory does not scale. Subscribe to the signals, match them against the exception register by CVE and component, and have the system reopen the item. A human then decides whether to fix, mitigate or re-accept with fresh approval. Treat re-acceptance as a new exception, with a new approver and a new end date.
Where Safeguard fits
Safeguard monitors findings continuously and surfaces zero-day and exploitation signals, so an accepted finding can be flagged for review when its context changes.
Try it yourself
Click through it at your own pace, or open it full screen. Watch how a new signal changes which findings need attention first.
Quick check
Does a high EPSS score alone justify revoking an exception?
It justifies a re-review. FIRST states EPSS is not a complete risk score, so combine it with exposure and impact before deciding.
Should a KEV listing always end the exception?
In practice yes, for reachable and exposed assets. If you keep one, treat it as a new decision with senior approval and strong compensating controls.
Sources
Last reviewed: 19 October 2026.
