Question 1

Which vulnerabilities should I fix first?

Accepted Answer

Anything in CISA KEV, today — those are confirmed active exploitation and the Known Exploited Vulnerabilities catalog is the strongest single signal available. Next, patch EPSS ≥ 0.1 findings that live on a reachable code path or production-exposed service, inside the current sprint. Then schedule CVSS-only critical findings in runtime code for the following sprint, treat everything else as normal patch cadence. That order maps exploitation probability to urgency instead of treating every CVSS 9.8 as an emergency.

Question 2

Is CVSS score enough to prioritize?

Accepted Answer

No. CVSS measures blast radius, not likelihood of exploitation — research shows ~12% of CVSS 9.0+ CVEs are ever weaponized. Sorting by CVSS alone means you work through a list that is ~88% false positives by volume while genuinely dangerous CVSS 6.x bugs with active exploits wait for weeks. CVSS vs EPSS: two scores, two different questions unpacks exactly where CVSS-only prioritization breaks and why EPSS is the prioritization signal.

Question 3

How does KEV membership change priority?

Accepted Answer

KEV is the override signal. When CISA publishes a vulnerability in the Known Exploited Vulnerabilities catalog, it has already been seen being exploited — no prediction, no probability. Treat KEV as a same-day patch requirement regardless of CVSS (a "moderate" KEV entry is still being actively attacked) and regardless of EPSS (the exploitation already happened, so 30-day probability is academic). If you only act on one signal, make it KEV.

Question 4

What EPSS threshold actually matters?

Accepted Answer

0.1 is where the curve turns. Roughly 85% of CVEs sit below EPSS 0.1; above that threshold, exploitation is measurably more likely than the base rate. Start with EPSS ≥ 0.1 as your "patch this sprint" trigger and EPSS ≥ 0.7 as your "patch this week" trigger. Tune from there based on your risk appetite — but avoid the temptation to raise the threshold high enough to make the queue empty, because that's how teams miss the 4% that are actually being exploited.

Question 5

How do I explain prioritization to engineering?

Accepted Answer

Frame it as economics, not security: you have limited patching capacity, CVSS alone forces you to spend 80%+ of it on vulnerabilities that no attacker will touch. The 3-Signal Method is how you redirect that capacity toward the ~5-10% of findings that will actually be used in an attack. Show engineers the alert-fatigue-funnel chart above — one slide, two numbers (total CVEs vs CVEs anyone will exploit), and it clicks. They don't need the theoretical argument; they need the queue to be shorter and more honest.

Question 6

How is the 3-Signal Triage Method different from what FIRST recommends?

Accepted Answer

FIRST (the organization behind EPSS) recommends using EPSS alongside CVSS but doesn't prescribe a specific workflow. The 3-Signal Triage Method is an opinionated implementation that adds CISA KEV as an override signal and defines concrete SLAs for each EPSS tier. It's a practical application of FIRST's research, not a competing standard.

Question 7

Can I automate the 3-Signal Method in CI/CD?

Accepted Answer

Yes. Set your CI pipeline to fail on KEV entries or EPSS above a threshold (0.7 is a good starting point). Let lower-priority findings generate tickets instead of blocking deploys. This prevents alert fatigue in CI while still catching genuinely dangerous vulnerabilities before they ship.

Question 8

What if a vulnerability has high EPSS but my application doesn't use the affected code path?

Accepted Answer

Reachability analysis is a valid fourth signal — but it requires deep static analysis that most tools don't provide yet. In practice, if a vulnerability is in a production dependency and has high EPSS, patch it. The cost of patching is almost always lower than the cost of proving unreachability.

Question 9

How often should I re-scan to catch EPSS changes?

Accepted Answer

Daily for production systems. EPSS scores change as new threat intelligence arrives — a vulnerability at EPSS 0.05 today can spike to 0.8 tomorrow when a proof-of-concept is published. Weekly scanning is the minimum for any system handling user data.

Question 10

Does the 3-Signal Method work for container image vulnerabilities too?

Accepted Answer

Yes. Container image scanners (Trivy, Grype) report CVEs with CVSS scores. You can layer EPSS and KEV data on top using the same framework. The signals are CVE-level, not ecosystem-specific — they work for OS packages, language dependencies, and application libraries equally.

---

Ready to see your vulnerabilities sorted by actual risk instead of CVSS severity?

Scan your dependencies now → — upload a lock file and get every finding enriched with CVSS, EPSS, and CISA KEV status. The 3-Signal Triage Method, applied automatically. No account needed.

For a practical application of this framework — turning a real 200-CVE scan into a 3-item action list — see What to Do When Your Scanner Finds 200 CVEs.

---

For the operational side of acting on your prioritized list, see Software Supply Chain Security Guide — a practical framework for building security into your dependency workflow.