Learn
Guides and definitions for vulnerability management: what the scores and catalogs mean, where they stop, and how to decide what to fix first.
Guide
Vulnerability prioritization beyond CVSS
How to decide what to fix first when CVSS, EPSS, and KEV don’t cover the bugs in your own code, and how to stop the same vulnerability coming back.
How-to
How to re-prioritize vulnerabilities when the risk changes
Priorities go stale when EPSS, KEV, or exposure changes. Record the facts behind each decision and re-open it when one of them changes.
Definition
What is EPSS?
EPSS estimates how likely attackers are to exploit a CVE in the next 30 days. How it works, how it compares to CVSS, and why it can’t score your own code.
Definition
What is the CISA KEV catalog?
The list of CVEs attackers have exploited. How a CVE gets added, how to use it, and why your own code is never in it.
Definition
What is BOD 26-04?
The CISA directive that sets federal patch deadlines from four questions about the asset and the exploit. The full deadline table and the compliance dates.