Question 1

Do I have to fix every vulnerability?

Accepted Answer

No — and trying to is the exact behaviour that breaks teams. Research from FIRST, VulnCheck, and Kenna converges on the finding that roughly 94% of published CVEs are never observed being exploited in the wild. Fixing every reported vulnerability treats that ~94% false-positive rate as acceptable and burns the capacity you need for the ~6% that will actually be used against you. Patch the exploited and likely-to-be-exploited findings on a short SLA; everything else goes in normal patch cadence with the rest of your housekeeping work.

Question 2

Which vulnerabilities can I safely defer?

Accepted Answer

Anything outside CISA KEV with EPSS below ~0.1 and no reachable attack path in your codebase — those can go in the normal patch cycle alongside regular dependency bumps. That usually covers the vast majority of a 200-CVE list. Do keep rescanning on a daily cadence so a deferred finding that suddenly spikes (PoC drops, malware adopts it) gets promoted automatically. Deferred is not the same as ignored; it just means it doesn't get emergency treatment today.

Question 3

How do I convince my team not to panic?

Accepted Answer

Reframe the list in front of them — start from the 200 number and apply the filters on screen: KEV (usually 1–3 items), then EPSS ≥ 0.1 (usually 5–15 items), then everything else. When a team sees the queue drop from 200 red boxes to a 10-item ordered list, the panic dissolves because the work is now finite and prioritized. Back it with the 94% data point, show the alert-fatigue funnel chart on screen, and close the loop with a written SLA per tier so the next scan doesn't re-trigger the panic cycle.

Question 4

How do I know which CVEs to fix first?

Accepted Answer

Apply the 3-Signal Method in order: (1) Check CISA KEV — anything on the list gets patched within 24 hours. (2) Sort by EPSS — CVEs above 10% get patched this week. (3) Use CVSS as a tiebreaker for similarly-scored EPSS items. This three-step sequence converts any CVE list into a prioritized action plan.