Question

A security analyst at a mid-sized firm is frustrated that the team's remediation backlog is dominated by thousands of medium-severity CVSS findings that rarely get exploited, while a handful of actually-exploited vulnerabilities linger. Management asks the analyst to recommend a scoring approach that better reflects the real-world likelihood that a given vulnerability will be exploited so the team can reorder its remediation queue. Which approach BEST meets this requirement?

Accepted Answer

Incorporate the Exploit Prediction Scoring System (EPSS) alongside CVSS to weight findings by their probability of exploitation

Answer

Continue sorting strictly by CVSS base score, remediating all Critical and High findings first

Answer

Rank findings solely by the age of the CVE, treating the oldest vulnerabilities as the highest priority

Answer

Prioritize based on the total count of affected hosts per vulnerability, regardless of severity