Question

Your security team is triaging a backlog of Dependabot alerts across several production repositories. Two alerts have the same CVSS base score of 7.5 (High). Alert A affects a vulnerability with an EPSS score of 0.92, while Alert B has an EPSS score of 0.03. With limited engineering capacity this sprint, which alert should be prioritized for remediation first, and why?

Accepted Answer

Alert A, because its high EPSS score indicates a much greater probability of being exploited in the wild in the near term.

Answer

Alert B, because a lower EPSS score means the vulnerability has been publicly disclosed longer and is therefore more urgent.

Answer

Neither can be prioritized, because CVSS is the only supported metric for ranking Dependabot alerts in GitHub.

Answer

Alert B, because EPSS measures severity of impact and a lower value reflects a more damaging exploit.