Rank a set of vulnerabilities by real-world risk using CVSS (severity), EPSS (exploit probability), CISA KEV (known exploited), and asset/exposure context — so remediation effort goes to what actually matters first. Use when a triaged finding list needs a defensible "fix this first" order.
Scanned 9/19/2026
Skills Directorynpx -y skills add jassics/awesome-claude-security --skill vulnerability-prioritization --agent claude-codeInstalls into .claude/skills of the current project.
Are you the author of Vulnerability Prioritization?
Add the live security badge to your README — it updates automatically with every re-scan.
[](https://www.skillsdirectory.com/skills/jassics-vulnerability-prioritization)More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.
---
name: vulnerability-prioritization
description: >-
Rank a set of vulnerabilities by real-world risk using CVSS (severity), EPSS
(exploit probability), CISA KEV (known exploited), and asset/exposure context —
so remediation effort goes to what actually matters first. Use when a triaged
finding list needs a defensible "fix this first" order.
---
# Goal
A risk-ranked, defensible remediation order — not just "sort by CVSS" — that a team
can act on and an auditor can understand.
# The signals (combine, don't rely on one)
- **CVSS base** — technical severity / worst-case impact. A ceiling, not a priority.
- **EPSS** — probability the CVE is exploited in the wild in the next 30 days. Cuts
the long tail of high-CVSS-but-never-exploited bugs.
- **CISA KEV** — on the Known Exploited Vulnerabilities catalog ⇒ treat as top
priority regardless of CVSS; active exploitation is confirmed.
- **Asset context** — criticality, internet exposure, data sensitivity, and
compensating controls. An internal, segmented, low-value host changes the math.
- **Exploit maturity / threat intel** — public PoC, weaponized, ransomware use
(pair with `threat-intelligence`).
# Steps
1. Pull CVSS, current EPSS score, and KEV membership for each CVE.
2. Apply a tiering rule, in order:
- **P1 / now:** on CISA KEV, or (internet-exposed AND high EPSS AND high impact).
- **P2 / SLA-fast:** high EPSS or critical CVSS on important assets.
- **P3 / scheduled:** everything else, ranked by EPSS then CVSS.
- **P4 / accept or defer:** low impact, low EPSS, well-mitigated, non-prod.
3. Adjust for asset context (exposure, criticality, compensating controls) — document
every up/down adjustment so the ranking is auditable.
4. Map each tier to a remediation **SLA** and route to `remediation-tracking`.
# Output
A ranked list with, per item: identifier · CVSS · EPSS · KEV(y/n) · asset context ·
assigned tier · SLA · one-line justification. Note any risk-accepted items with owner
and review date.
# Notes
CVSS alone over-prioritizes: most high-CVSS CVEs are never exploited. EPSS + KEV is
what separates theoretical from real risk. KEV is non-negotiable — if it's being
exploited in the wild, severity score is irrelevant. Re-score periodically: EPSS and
KEV change over time, so today's P3 can become tomorrow's P1.
Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.
No comments yet. Be the first to comment!
