Sort an SCA report by known exploitation first, then by whether the package runs in production, then by reachability, and only then by severity. Severity describes a flaw in general. The earlier columns describe your exposure, which is what decides what to fix this week.
Why not start with severity
Severity scores are useful and widely used, but they were not designed to rank your work. FIRST, the body behind CVSS, says the CVSS Base Score represents only the intrinsic characteristics of a vulnerability that are constant over time and across user environments, and should be supplemented with contextual analysis. In other words, two teams with the same library version and the same score may face very different risk.
Sorting by severity gives you a queue where a critical flaw in an unused test helper sits above a medium flaw in a library that handles untrusted input. The order below fixes that.
The sort order
| Priority | Column | Question it answers |
|---|---|---|
| 1 | Known exploited flag | Are attackers using this now? |
| 2 | Scope | Does it ship to production or only live in development? |
| 3 | Reachability | Does my code call the vulnerable function? |
| 4 | Exploit probability | How likely is exploitation in the near term? |
| 5 | Severity | How bad is the flaw if exploited? |
| 6 | Fix effort | Patch, minor or major upgrade? |
What each signal means
Known exploited. CISA's Known Exploited Vulnerabilities catalog lists vulnerabilities with an assigned CVE ID, reliable evidence of active exploitation in the wild, and a clear remediation action. A match here moves a finding to the top because the question of whether attackers care is already answered.
Scope. GitHub's Dependabot documentation notes that filtering for development-scoped alerts helps you prioritize alerts that affect production dependencies first. The same idea applies to any report.
Reachability. Whether your code can reach the vulnerable function. See how to read the vulnerable function column.
Exploit probability. FIRST describes EPSS as the probability a vulnerability will be exploited in the wild within the next 30 days, a score between 0 and 1 updated daily. It does not include context about your environment, so it supports a risk calculation rather than replacing one.
A short worked order
Imagine four findings: A is known exploited and runtime, B is critical but development only, C is high and runtime with a reachable function, D is medium and runtime with no call path. The order is A, C, D, B. Plain severity would have put B first.
Try it yourself
Click through it at your own pace, or open it full screen. Try changing the sort and watch which findings move to the top.
Where Safeguard fits
Safeguard combines dependency scanning with reachability analysis and policies, so you can set gates and rules on signals beyond severity. You can try it with a free scan at gold.safeguard.sh/scan.
Quick check
Is EPSS a replacement for CVSS?
No. EPSS estimates exploitation likelihood, CVSS describes severity. They answer different questions, and neither knows your environment.
Do I ignore low severity findings?
No, but they usually come later. A low severity flaw that is known exploited and reachable deserves attention.
Sources
- FIRST, CVSS v3.1 user guide
- FIRST, EPSS FAQ
- CISA, Known Exploited Vulnerabilities
- GitHub Docs, Viewing and updating Dependabot alerts
Last reviewed: 19 October 2026.
