CVE, CVSS, EPSS: What Those Numbers Actually Mean — and Why Patching by Severity Wastes 96% of Your Effort
Every security alert you'll ever read is full of codes: CVE-2026-50522, CVSS 9.8, EPSS 0.94. They look like jargon designed to exclude you. They're not — they're three different answers to three different questions, and knowing which one to trust is the difference between an impossible patch list and a manageable one. Here's what each number means, in plain English, and the research showing why most businesses prioritize exactly wrong.
Open any threat advisory, vulnerability scan, or security bulletin and you'll be met with a wall of identifiers and scores. CVE-2026-50522. CVSS: 9.1. Maybe EPSS: 0.87. For anyone without a security background, the natural reaction is to find the biggest number, assume it's the worst thing, and start there.
That instinct is reasonable. It's also, according to the research, the most wasteful way to prioritize.
These three systems answer completely different questions. One tells you what the flaw is. One tells you how bad it would be if someone exploited it. And one tells you whether anyone is actually likely to. Most businesses only ever look at the middle one — and that single habit is why patch lists become impossible and the wrong things get fixed first.
of the effort is wasted when you patch everything rated "High" severity or above
Research published by FIRST — the organization that maintains both the CVSS and EPSS standards — found that remediating every vulnerability with a CVSS score of 7 or higher does catch 82% of the flaws that actually get exploited. But it also means fixing an enormous volume of vulnerabilities that were never going to be attacked: 96% of that work is effort spent on threats that never materialize. For a business with a security team, that's inefficiency. For a small business with no security team and no spare hours, it's the reason the list never gets finished.
The three numbers, in plain English
"What is it?" — the name tag
A CVE (Common Vulnerabilities and Exposures) identifier is simply a unique name for a specific security flaw in a specific product. That's all it is. It carries no judgement about severity or danger — it's a catalog number, so that everyone in the world discussing the same flaw is definitely discussing the same flaw.
The format is CVE-YEAR-NUMBER. The year is when the identifier was assigned, and the number is just a sequential ID. A CVE is assigned as soon as a vulnerability is disclosed, which is why you'll sometimes see a CVE with no score attached yet — the analysis that produces a score comes later, and some vulnerabilities in obscure products never get formally scored at all.
"How bad would it be?" — the severity score
CVSS (Common Vulnerability Scoring System) rates a flaw from 0 to 10 based on its technical characteristics: how easy it is to exploit, whether an attacker needs existing access, and how much damage a successful exploit would cause. Higher means worse consequences.
Here's the crucial limitation, and it's the reason this whole post exists: CVSS measures potential impact, not likelihood. It describes how bad the outcome would be in a worst case. It says nothing about whether any attacker anywhere is actually trying to exploit it. A theoretical flaw in software almost nobody runs can score 9.8 and never be attacked once.
"Will anyone actually use it?" — the probability score
EPSS (Exploit Prediction Scoring System) is the number almost nobody outside security has heard of, and for a small business it's arguably the most useful of the three. Introduced in 2019 and maintained by the same organization that runs CVSS, EPSS estimates the probability that a given vulnerability will be exploited in the wild within the next 30 days.
It's expressed as a decimal between 0 and 1, which is just a percentage: an EPSS of 0.02 means roughly a 2% chance of exploitation in the next month; 0.94 means roughly 94%. It's produced by a machine-learning model trained on observed real-world exploitation — data from honeypots, incident reports, threat-intelligence partners, and confirmed-exploitation catalogs — and it's recalculated every single day for every published CVE.
You may also see an EPSS percentile, which is a ranking rather than a probability. A percentile of 0.98 means that vulnerability is more likely to be exploited than 98% of all other known vulnerabilities.
Side by side
| CVE | CVSS | EPSS | KEV | |
|---|---|---|---|---|
| Answers | Which flaw? | How bad if exploited? | How likely to be exploited? | Is it being exploited? |
| Format | CVE-2026-12345 | 0 – 10 score | 0 – 1 probability | On the list, or not |
| Updates | Assigned once | Rarely changes | Recalculated daily | Added as confirmed |
| Type | Identifier | Severity | Prediction | Confirmed fact |
| Blind spot | No risk info | Ignores real-world activity | Doesn't know your environment | Only covers what's confirmed |
Why patching by severity alone gets it wrong
The FIRST research is the clearest evidence available on this, and it's worth stating precisely. Two approaches, compared:
Patch everything rated CVSS 7 or higher. You'll catch 82% of the vulnerabilities that actually get exploited — good coverage. But 96% of the work you do will be on vulnerabilities that were never going to be attacked. You'll spend the overwhelming majority of your time on non-threats.
Patch everything with an EPSS of 10% or higher. You'll catch 63% of the ones that get exploited — less coverage, but with dramatically less wasted effort. And the comparison that really lands: to get coverage comparable to patching everything at EPSS 80%+, a CVSS-driven approach requires patching roughly ten times as many vulnerabilities.
The four combinations — and what to do with each
Once you're reading two numbers instead of one, every vulnerability falls into one of four boxes. This is the practical payoff:
How to use this in practice
You don't need to memorize any of this. What's worth carrying away is a single change in habit: when you see a severity score, ask the second question. Not just "how bad is this?" but "is anyone actually doing it?"
In practice, that means a simple order of operations. First, check whether the flaw is in the confirmed-exploited catalog — if it is, that settles it, patch now. Second, check whether it affects something you actually run and whether that system is exposed to the internet. Third, look at the exploitation probability, not just the severity, to sort what's left. Anything severe-but-improbable goes on the normal update cycle rather than the emergency list.
All of these numbers are free and public. CVE identifiers and CVSS scores are published in the National Vulnerability Database, EPSS scores are published daily by FIRST, and the confirmed-exploited catalog is published by CISA. Nothing here requires a subscription. What it requires is knowing which number answers which question — which, until now, has been the part nobody explained to small businesses.
The short version
CVE is the name of the flaw. CVSS is how much damage it could do. EPSS is how likely anyone is to try. KEV means they already are.
Severity tells you what would hurt. Probability tells you what's coming. Most businesses only read the first one — and then wonder why a list that long never gets finished. Read both, and the impossible list becomes a short one.
See today's threats already sorted by what's actually being exploited — free, live, and in plain language.
View the Threat Intelligence feed → Find Out More About Veriti Spottr →📚 Credential Security Series — Read the full series
Comments
Post a Comment