03 - Prioritization and EPSS Scoring

Prioritization is the heart of Risk-Based Vulnerability Management (RBVM). With organizations facing thousands of vulnerabilities, you must determine what to fix first.

The Fallacy of CVSS Alone

The Common Vulnerability Scoring System (CVSS) provides a standard way to assess the technical severity of a vulnerability. However:

• CVSS is static. It does not change over time based on threat actor behavior.
• CVSS assumes the worst-case scenario.
• Relying solely on CVSS 7.0+ (High/Critical) forces teams to patch vulnerabilities that have never been exploited in the wild, wasting resources.

The Modern Prioritization Stack: KEV + EPSS

To prioritize effectively, combine CVSS with real-world threat intelligence.

1. CISA KEV (Known Exploited Vulnerabilities)

The Cybersecurity and Infrastructure Security Agency (CISA) maintains a catalog of CVEs that are confirmed to be actively exploited in the wild.

• Rule of Thumb: If a vulnerability is on the KEV list, it is an immediate patching priority, regardless of its CVSS score.

2. EPSS (Exploit Prediction Scoring System)

Managed by FIRST (the same organization behind CVSS), EPSS provides a dynamic, data-driven probability (from 0% to 100%) that a vulnerability will be exploited in the wild within the next 30 days.

• It analyzes threat intelligence, dark web chatter, exploit kits, and honeypots.
• Example: A CVSS 9.8 vulnerability with an EPSS of 0.01% (highly unlikely to be exploited) vs. a CVSS 6.5 vulnerability with an EPSS of 85% (highly likely to be exploited). Patch the 85% EPSS first!

---

The Prioritization Matrix

You can build a powerful prioritization framework by combining these metrics:

Priority Tier	Criteria	Action SLA
P0 (Critical)	CISA KEV listed OR EPSS > 50%	24 - 48 Hours
P1 (High)	EPSS > 20% OR (CVSS > 9.0 on Internet-Facing Asset)	7 - 14 Days
P2 (Medium)	CVSS > 7.0 + High Asset Criticality	30 Days
P3 (Low)	Standard CVSS findings, low EPSS	90 Days / Next Cycle

---

Working Python API Scripts: Fetching EPSS Data

You can query the free FIRST API to fetch the latest EPSS scores for a list of CVEs.

import requests
import json

def get_epss_scores(cve_list):
    """
    Fetches EPSS scores for a list of CVEs using the FIRST API.
    """
    # EPSS API endpoint
    url = "https://api.first.org/data/v1/epss"
    
    # Format CVEs as a comma-separated string
    cve_query = ",".join(cve_list)
    params = {"cve": cve_query}
    
    try:
        response = requests.get(url, params=params)
        response.raise_for_status()
        data = response.json()
        
        results = {}
        if "data" in data:
            for item in data["data"]:
                cve = item["cve"]
                epss = float(item["epss"]) * 100  # Convert to percentage
                percentile = float(item["percentile"]) * 100
                results[cve] = {"epss_prob": epss, "percentile": percentile}
                
        return results
    except Exception as e:
        print(f"Error fetching EPSS data: {e}")
        return None

# Example Usage
cves_to_check = ["CVE-2021-44228", "CVE-2023-38831", "CVE-2019-0708"]
scores = get_epss_scores(cves_to_check)

print("EPSS Scores:")
print("-" * 40)
for cve, data in scores.items():
    print(f"{cve}: Probability: {data['epss_prob']:.2f}% | Percentile: {data['percentile']:.2f}")

Expected Output

EPSS Scores:
----------------------------------------
CVE-2021-44228: Probability: 97.54% | Percentile: 100.00
CVE-2023-38831: Probability: 88.12% | Percentile: 98.45
CVE-2019-0708: Probability: 95.31% | Percentile: 99.80