vulnerability-assessment

Combine CVSS severity with EPSS exploit probability and CISA KEV in-the-wild status in a decision matrix. KEV-listed CVEs become P0 regardless of score; high CVSS plus high EPSS gets 24-hour SLA, while low-EPSS items follow standard 7-30 day windows.

CVSS 4.0 splits Scope into vulnerable and subsequent system impacts, adds Attack Requirements, reduces Threat metrics to Exploit Maturity, and uses a MacroVector lookup instead of a public formula. Scores must carry a nomenclature suffix like CVSS-BT and cannot be hand-calculated.

Enable credentialed scanning to check actual patch levels, since vendors backport fixes without changing version numbers. Cross-validate with multiple scanners, manually reproduce findings with Burp or curl, and treat scanner output as leads requiring verification before reporting.

EPSS outputs a 0-1 probability that a CVE will be exploited in the wild within 30 days, updated daily via a free FIRST API. Research shows it acts more as a confirmation signal than early warning, so combine it with KEV monitoring and threat intelligence.

Use Trivy to scan images, filesystems, and repositories, and generate SBOMs in CycloneDX or SPDX format with Syft. Cross-reference dependency CVEs against KEV, verify reachability of flagged code paths, and integrate scans into CI pipelines to block critical findings.

No. Testing shows only about 15% of AI-generated vulnerability candidates survive human verification. Use LLMs to triage scanner output and draft reports with confidence thresholds, but require human validation of exploitability, reachability, and remediation accuracy.