Skip to content
T threat.cafe

· Constance Ibe-Whitmore (editorial persona) · Intel commons after NVD · on threat.cafe

KEV first, EPSS second, everything else on schedule: a written prioritisation policy for teams that will never patch 66,000 CVEs

A small team cannot remediate every published CVE, and a defensible policy does not pretend otherwise. The FIRST mid-year forecast projects around 66,000 CVEs for 2026, while the share actively exploited "remains remarkably stable at well under 1%" (Trend Micro, 21 July 2026). The policy below ranks findings first by confirmed exploitation (the CISA KEV catalog), then by probability of exploitation (EPSS), and places everything else on a scheduled cycle. Each tier carries a written deadline that an auditor can test and a board can read.

What changed in 2026, and why a CVSS-only policy no longer holds

Three developments make a severity-only policy difficult to defend in 2026.

Volume. The 2025 total "finished at a record 48,185 CVEs," up from roughly 40,000 in 2024, and FIRST projects about 66,000 for 2026 (Trend Micro). A policy that requires remediation of every "High" finding within a fixed window will be breached by arithmetic, not by negligence.

Enrichment. From 15 April 2026, NIST stopped aiming to analyse every CVE. Full enrichment now goes to CVEs in the KEV catalog, CVEs in software used by the federal government, and critical software under Executive Order 14028, which the Cloud Security Alliance estimates at 15-20% of annual volume. About 29,000 backlogged CVEs published before 1 March 2026 moved to "Not Scheduled" (CSA Labs, 29 April 2026). A policy that keys deadlines to "the NVD CVSS score" will now meet many CVEs that have none.

Efficiency. The EPSS authors compare a "remediate CVSS 7 or higher" rule with an EPSS-based rule. The CVSS rule required 50.7% of the effort for 74.6% coverage of exploited vulnerabilities. The EPSS rule held coverage at about that level while effort fell "from 50.7% down to 6%" (Empirical Security, EPSS v4 introduction). The page does not state the comparison date, so treat the figures as indicative of the gap, not as a guarantee for your estate.

Legal and contractual status of the two inputs

The policy must distinguish what is mandated from what is adopted voluntarily.

  • KEV. CISA's Binding Operational Directive 22-01 (3 November 2021) requires federal executive-branch agencies to remediate KEV entries "within two weeks" for CVEs assigned in 2021 or later and "within 6 months" for older CVE IDs (CISA, BOD 22-01). The directive does not bind private organisations. CISA says the catalog "can serve as a great starting point" for organisations without a programme.
  • EPSS. EPSS is a FIRST model that "estimates the probability that a published CVE will be exploited in the wild in the next 30 days," published daily for every CVE (FIRST). It carries no regulatory status. The user guide states that "EPSS should never be treated as a risk score" (FIRST EPSS user guide); it measures threat only, not asset value or exposure.

A private organisation that adopts BOD 22-01 timelines does so by choice. That choice is easier to defend in an audit than an invented deadline, because it borrows a published federal benchmark.

The tier and deadline table

Read this as a template. The deadlines for Tiers 1 and 2 follow BOD 22-01. The EPSS threshold and the Tier 3 and Tier 4 windows are starting values for your team to set and record, not published standards.

Tier  Entry condition                                  Remediation deadline       Exception route
----  -----------------------------------------------  -------------------------  ----------------------------
1     KEV-listed AND asset reachable from the internet 7 calendar days            CISO, written, 7-day expiry
2     KEV-listed, any other asset                      14 calendar days           CISO, written, 30-day expiry
                                                       (6 months if CVE pre-2021)
3     Not KEV; EPSS probability >= team threshold      30 calendar days           Asset owner, logged
      (template start: 0.10, reviewed quarterly)
4     Everything else                                  Next scheduled patch cycle Asset owner, logged
                                                       (template: within 90 days)

Two rules sit above the table. First, a finding moves up a tier the day it qualifies, for example when CISA adds it to KEV, and its clock restarts from that day. Second, compensating controls (isolation, disabling the vulnerable feature) may satisfy a Tier 1 or Tier 2 deadline only if the exception is written and dated.

Template policy text (must / should / may)

The following clauses are written for adoption with minimal editing. Square brackets mark values your organisation must choose.

  1. Scope. This policy applies to all systems listed in the asset inventory. The security team shall maintain that inventory, including whether each asset is reachable from the internet.
  2. Inputs. The vulnerability management function shall check findings daily against the CISA Known Exploited Vulnerabilities catalog and shall retrieve current EPSS probabilities for all open findings at least weekly.
  3. Tier assignment. Each finding must be assigned the highest tier for which it qualifies. Tier assignment must not depend on the availability of an NVD CVSS score.
  4. Severity data. Where NVD has not enriched a CVE, the team may use the CNA-supplied or vendor-advisory score for reporting purposes. Such scores shall not lower a finding's tier.
  5. Deadlines. Findings must be remediated or covered by an approved exception within the deadline for their tier.
  6. Threshold review. The EPSS threshold shall be reviewed each quarter. The review should record the number of open findings above the threshold and the share of KEV entries in the estate that were not already above it.
  7. Exceptions. Exceptions for Tier 1 and Tier 2 must be approved by [CISO or delegate], must name the compensating control, and must expire. Exceptions for Tiers 3 and 4 may be approved by the asset owner.
  8. Reporting. Reports to leadership should not present raw CVE counts. Trend Micro's CISO puts it plainly: "Raw numbers frighten without informing" (Trend Micro).

This template is general information, not legal or audit advice. Contractual obligations, sector regulators and frameworks your organisation reports against (PCI DSS, FedRAMP, ISO 27001) may impose stricter timelines; confirm with your auditor or counsel before adoption.

The board slice

A director needs to know whether the exploitable exposure is under control, not how many CVEs exist. Three figures, reported quarterly, answer that:

  • Tier 1 and 2 on time: the share of KEV-listed findings remediated within deadline in the quarter.
  • Oldest open Tier 1 or 2 finding: in days, with its exception status.
  • Exceptions open: the count of written exceptions, and how many expired without renewal.

Each figure can be traced to a ticket, which is what an auditor will test.

Questions auditors and counsel will ask

"Why not remediate every High and Critical?" Answer with the arithmetic. The critical share of CVEs fell from about 13% in 2024 to 7% in 2025 according to a Zafran analysis cited by Trend Micro, yet on 2026 volumes even 7% is several thousand records. The EPSS comparison shows that severity rules spend most of their effort on vulnerabilities that are not exploited.

"Is EPSS accepted?" EPSS is not a regulatory standard. It is a published, documented model from FIRST, and the policy uses it only to order work that falls outside KEV. Clause 3 ensures that a low EPSS score never removes a KEV entry from Tier 1 or 2.

"What about CVEs NVD will not enrich?" Clauses 3 and 4 mean the policy still works. KEV entries are enriched by NIST, and EPSS v4 uses cve.org CNA/ADP data "as backup to NVD enrichment" according to its authors.

"Who signed the exceptions?" Clause 7 makes this answerable from the record.

Ambiguities to resolve before adoption

Reachability. "Reachable from the internet" requires a definition your inventory can support. If the inventory cannot state reachability, treat every KEV finding as Tier 1 until it can.

Threshold drift. EPSS probabilities change daily. A finding may cross the threshold and fall back. The team should decide whether the Tier 3 clock stops when the score falls; the template assumes it does not.

Non-CVE risk. Malicious packages, compromised extensions and agent artifacts usually carry no CVE at all and will never appear in KEV. This policy does not cover them; they need a separate known-bad control.

For that last gap, threat.cafe's early-access known-bad list covers malicious packages, skills and MCP servers that no CVE-based policy will see.

Sources

#vulnerability-management #kev #epss #nvd #policy-template

All posts