When organizations have vulnerability backlogs too large to fix, the obvious answer may be to start with the highest-severity findings. However, severity on its own does not indicate which vulnerability is most likely to cause harm.
The urgency of a vulnerability also depends partly on where it occurs and whether attackers are already exploiting it. For example, a lower-scored flaw on an internet-facing system may need faster remediation than a critical vulnerability with no known exploitation.
The limits of CVSS
The Common Vulnerability Scoring System (CVSS) is often the most familiar and natural starting point for vulnerability prioritization. It rates the severity of a vulnerability on a scale from 0-10, based on how it can be exploited and the damage it could cause.
The problem is that it does not show how likely a vulnerability is to be exploited in the real world. A team that works only from the highest CVSS scores can spend weeks on vulnerabilities that attackers have shown no interest in.
CVSS remains useful, but it is most effective when combined with other factors to help determine which vulnerabilities need attention first.
Adding EPSS and KEV into the process
EPSS, the Exploit Prediction Scoring System, estimates the probability that a vulnerability will be exploited in the wild in the next 30 days. It’s based on real-world data such as whether exploit code is publicly available and what exploitation activity has been observed.
Then there’s the Cybersecurity and Infrastructure Security Agency (CISA), which maintains the Known Exploited Vulnerabilities (KEV) catalog. It lists vulnerabilities with evidence of exploitation, so it’s useful input when deciding which findings should be addressed first.
When used together, the three give teams more complete information for ranking vulnerabilities:
-
CVSS describes how severe a vulnerability is.
-
EPSS shows the likelihood that attackers will exploit it.
-
KEV confirms whether attackers are already exploiting it.
For example, a flaw in Cisco firewalls, listed as CVE-2025-20362, was published in 2025 with a Medium CVSS score of 6.5. Attackers were already exploiting it, and CISA added it to KEV the same day.
Vulnerabilities listed in KEV generally need urgent attention, especially when affected systems are exposed, and a high EPSS score can point to the next vulnerabilities most likely to be exploited.
Keep in mind that CVSS, EPSS, and KEV still need to be considered along with the vulnerability’s environment.
The challenge of vulnerability remediation
While it’s important to prioritize which vulnerabilities teams address first, that still doesn’t guarantee they will be remediated correctly. Fixing a finding requires understanding how the vulnerability arises and what needs to change to prevent it. Automated tests and security scans can help validate a fix, but they may miss flaws outside their coverage.
AI-assisted development adds another dimension to this challenge. Research across Fortune 50 enterprises found that monthly security findings from AI coding assistants rose from about 1,000 to more than 10,000 over six months. That increase puts additional pressure on teams to assess findings and decide how to address them.
AI assistants can suggest remediation code, too, but generating a fix doesn’t establish that it works. Developers need to understand the security issue well enough to assess the proposed change and recognize when it leaves the vulnerability unresolved.
Building remediation capacity
Teams need enough resources to work through vulnerability backlogs, along with the skills to fix vulnerabilities correctly. Training can help developers build those skills, particularly when it focuses on the issues they find in their work.
Backlog data can help identify where practical experience is most needed. If the same vulnerability type keeps appearing, targeted hands-on exercises can help developers build the skills to prevent similar mistakes. Preventing a vulnerability type from recurring also reduces how many findings the team has to prioritize and fix later.
Supporting effective vulnerability remediation
ThreatCanvas, SecureFlag’s automated threat modeling solution, helps teams identify security risks during design, before they make their way into shipped code.
For vulnerabilities that do reach development, SecureFlag’s hands-on labs give developers practical experience identifying and fixing flaws, while just-in-time training connects security findings to relevant exercises.
SecureFlag’s MCP Server also brings threat modeling and training capabilities into supported AI coding assistants.
Talk to our team to see how SecureFlag can help your organization.
