Ask the demo which score sits behind each label. CVSS describes severity, EPSS estimates the probability of exploitation in the next 30 days, and CISA's KEV catalog lists vulnerabilities known to be exploited. A good tool shows which signals it uses and lets you inspect them.
Three signals, three questions
| Signal | What it answers | Source |
|---|---|---|
| CVSS | How severe is the flaw in principle? | FIRST standard |
| EPSS | How likely is exploitation soon? | FIRST model, updated daily |
| KEV | Is exploitation already confirmed? | CISA catalog |
FIRST describes CVSS as a way to capture the principal characteristics of a vulnerability and produce a numerical score reflecting its severity, which can be translated into low, medium, high and critical (see Sources). It is a severity measure.
FIRST describes EPSS as a model that estimates the probability that a published CVE will be exploited in the wild in the next 30 days, published daily as a value from 0 to 1 (see Sources).
CISA states that it maintains the authoritative source of vulnerabilities exploited in the wild and that organizations should use the KEV catalog as an input to their vulnerability management prioritization framework (see Sources).
What to ask in the demo
- Which of these three signals does the tool show on a finding?
- If it shows a single priority label, how is it computed?
- Can I see the inputs for one finding?
- Can I change the weighting or add my own factors, such as internet exposure or business criticality?
- How often is exploit data refreshed?
A black box label with no inputs is hard to defend to your own developers. If a finding is marked urgent, someone will ask why.
Test it on two findings
Find one finding with a high CVSS score and low exploitation likelihood, and one with a lower score that appears in the KEV catalog. Ask the tool to show how each is ranked. There is no universal correct order, but you should understand and agree with the logic.
You can look up the KEV status of any CVE yourself while the demo runs. Open the catalog in a second tab and search by identifier. Compare it with what the tool shows.
Adding context
None of the three signals knows your environment. A severe flaw in a library that your code never calls, or in a service not exposed to the internet, may deserve different treatment. Ask how the tool brings in context, and whether that context is visible.
Where Safeguard fits
Safeguard combines dependency scanning with reachability analysis and exploit status, so priorities can reflect whether a flaw is both exploited and reachable. The demo below walks through an exploitability check.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at which signals are visible on a finding, and what you would still need to decide yourself.
Quick check
Is a high EPSS value the same as a high CVSS score?
No. EPSS estimates likelihood of exploitation. CVSS describes severity. A flaw can be high on one and low on the other.
Does absence from KEV mean a flaw is safe?
No. It means CISA has not listed it as exploited. Use it with other signals.
Sources
- FIRST, Common Vulnerability Scoring System
- FIRST, Exploit Prediction Scoring System
- CISA, Known Exploited Vulnerabilities Catalog
Last reviewed: 19 October 2026.
