Kategori: Risk and Prioritization
The CISA KEV Catalog: What Gets Listed and Why It Matters
How CISA decides what enters the KEV catalog, what each field means, why the list stays small on purpose, and how to…
A KEV Entry With No Patch: Your Options Before the Fix
A KEV entry with no vendor patch still demands action: the mitigation ladder, stopgap detection, and a risk acceptance record that survives…
Where EPSS Falls Short: Blind Spots in Exploit Prediction
EPSS misses internal-only bugs, targeted exploitation and brand-new CVEs. Where its blind spots are, and how to compensate with exposure and KEV…
Inside the EPSS Model: What Data Predicts Exploitation
How does EPSS work: the features, ground truth, retraining cadence and calibration behind exploitation prediction, and how to use it without breaking…
How to Read an EPSS Score: Probability vs Percentile
EPSS score explained: probability vs percentile, why a low probability can rank in the 94th percentile, and what the score cannot tell…
When NVD and the Vendor Disagree on a CVE’s Severity
NVD and vendor CVSS scores for the same CVE often diverge sharply. See documented cases and get a tiebreak policy your team…
CVSS 4.0 Supplemental Metrics: Safety, Recovery, Automatable
CVSS v4.0 Supplemental metrics (Safety, Automatable, Recovery, Value Density, Provider Urgency) never change the score. Here is how to route on them…
CVSS Attack Vector and Complexity: A Practical Breakdown
A practical guide to CVSS Attack Vector, Attack Complexity and Attack Requirements, with real CVE examples and a ten second method for…
Why CVSS Severity Alone Is a Broken Patch Priority List
CVSS scores technical severity, not real-world risk. See why Critical-heavy queues mislead patch teams and what should replace severity as the sort…
CVSS Threat Metrics and Exploit Code Maturity Explained
CVSS Exploit Code Maturity and v4 Threat Metrics decoded: value definitions, real score multipliers, evidence sources, and how often to re-score findings.