Severity is not the
same thing as risk.
CVSS tells you how bad a vulnerability could be. EPSS tells you how likely it is to be exploited. KEV tells you whether it already is. Used alone each one misleads; combined they give you an order of work you can defend.
16,412 CVEs analysed. Severity says 38.7% of them deserve your weekend. Confirmed exploitation accounts for 0.82%. Scoring is what tells those two populations apart.
Corpus totals read live from the analysis database; KEV overlap is read live against CISA's catalogue of 1,694 entries, resynced hourly.
Two axes, and only one of them is on your patch list
Plot severity against probability and the misallocation becomes visible. The upper-left is where severity-sorted queues spend their time: genuinely serious flaws that nothing in the world is attacking. The narrow band on the right is where the breaches come from — and some of it sits below the high-severity cutoff entirely.
Worked example — the 20 points are illustrative and the shape, not any individual dot, is the argument. The ratio behind it is measured: of 16,412 analysed CVEs, 135 appear in CISA’s Known Exploited Vulnerabilities catalogue. 0.82%.
A 9.8 and a 6.5 land on your desk the same morning
Every severity-ordered queue in the industry patches the 9.8 first. Look at all three inputs and the order inverts — and it is not close.
Deserialization RCE
internal application server, not internet-facing
Close to the top of the severity scale, with no observed exploitation and no place in the KEV catalogue. Real, worth fixing, and almost certainly not what breaches you this month.
Sorted by severity, this is your number one.
Authentication bypass
edge VPN appliance, reachable from the internet
A medium score, an 88% modelled chance of exploitation activity in the next thirty days, and a confirmed place on CISA’s exploited-in-the-wild list. The argument is over.
Sorted by severity, this is sixth — below three vulnerabilities nothing in the world is attacking.
Patch B first. Not because it is more severe — it is 3.3 points less severe — but because it is the one being used. A vulnerability forty-four times more likely to see exploitation activity, and confirmed in the wild, outranks a theoretical 9.8 every time.
A is still work. It is next week’s work. Scoring does not tell you to ignore things; it tells you what order to do them in, and gives you a reason you can put in front of an auditor.
The same seven CVEs, sorted twice
Left, the queue you get from severity alone. Right, the queue you get when likelihood and confirmed exploitation are folded in. Six of the seven move. The one that travels furthest is the one that was going to hurt you.
Worked example, continuing A and B from above. Cyan lines rise; faded lines fall.
Three signals. Each one answers a different question.
Most of the confusion in vulnerability management comes from treating these as interchangeable numbers. They are not. Here is exactly what each one measures, and — more usefully — what it does not.
Set at publication; revised rarely
A 0–10 description of the technical worst case: how reachable the flaw is, what it takes to trigger, and what an attacker gains if they succeed.
Not a measure of likelihood. A 9.8 does not become a 10 the day a working exploit ships, and it does not fall when the world ignores it for a decade.
Recomputed daily — we sync daily
A probability between 0 and 1 that exploitation activity will be observed against this CVE somewhere in the world in the next 30 days, from a model trained on real-world activity.
Not a statement that you are being attacked, and not a severity score. It is population-level and it moves — today’s 0.03 can be next week’s 0.6.
Synced hourly — a CVE can be added within hours
A binary fact: this vulnerability has been confirmed exploited against real targets. No model, no estimate, no argument left to have.
Not a complete census of everything being exploited. Absence from the catalogue is not evidence of safety — it is only the absence of confirmation.
EPSS is refreshed daily and the KEV catalogue hourly, so the ordering keeps up with the threat rather than the disclosure date.
Scored before it is sent. The severity band, the CVSS number and a KEV tag ride in the subject line and the body of every email, Telegram and Slack alert.
The treemap sizes and colours tiles by real exposure, so the technology carrying genuinely urgent work is the one that dominates the view.
Move each CVE through open, in progress, deferred, risk accepted and closed. Anything dispositioned drops out of the outstanding view, so the ordering stays about work you still owe.
Pull the same scored records — CVSS, EPSS, KEV and your own status on each — over the REST API with a key on Max, or export a PDF when someone needs the ordering on paper.
Stop patching in disclosure order
Add the technologies you run and every CVE that touches them arrives already scored on severity, probability and confirmed exploitation.
Start free