Your Vulnerability Scanner Is Lying to You. Here's Why CVSS Alone Is a Broken Strategy in 2026.

Every security team I have talked to has the same problem. You run a vulnerability scan, the report comes back with hundreds or sometimes thousands of findings, and then somebody has to sit down and figure out what actually matters. Most teams do what feels logical, they sort by CVSS score, start at the top and work their way down. Critical first, then high, then medium. Nobody ever really gets to the lows because by the time the criticals are done there is already another scan waiting.

It feels like the right thing to do and it looks good on a compliance report. But it does not actually work very well, and the more time I have spent doing vulnerability management hands on, the more obvious that has become.

I did not fully get this phrase until I was actually sitting in front of a Nessus scan output trying to figure out which of these 400+ findings needed my attention today versus week versus probably never. CVSS describes the technical characteristics of a vulnerability. How bad the impact could be, what the attack vector looks like, whether it needs user interaction. That is useful information but it is answering a different question than the one you are actually asking when you open that report.

What you really want to know is which of these things is most likely to be used against you right now. And CVSS just cannot tell you that. What you need to know is a vulnerability can sit at a critical 9.8 for years without anyone ever writing a working exploit for it. Meanwhile something rated 7.5 has a Metasploit module and is actively being used in ransomware campaigns. So, if you are just going by CVSS, you might be spending all your time on the 9.8 while the 7.5 is the one that actually gets you breached.

The scale of the problem is getting worse too. There were over 59,000 vulnerabilities disclosed in 2025 and barely 1% of them were actively exploited. But the ones that were exploited caused serious damage, often before organizations had the time to do anything it. Something like 29% of the vulnerabilities added to CISA’s Known Exploited Vulnerabilities catalog were being exploited on the same day they were publicly disclosed. The gap between when a vulnerability shows up and when someone weaponises it is shrinking fast, and a prioritisation strategy based on CVSS scores just cannot account for that because it was never designed to.

Attackers are not looking at your scan report and picking the highest number. They want three things from a vulnerability. There needs to be a working exploit they can actually use. The target has to be reachable, either directly from the internet or from wherever they already have a foothold on. And the vulnerability needs to give them something worthwhile, like code execution or a way to escalate their privileges.

That is why the same pattern keeps repeating. A vulnerability gets disclosed, someone drops a proof of concept on GitHub within a few days, it gets picked up by automated toolkits, and before long it is being used at scale. A lot of the organisations that get hit in these campaigns had the vulnerability on their patching list already. They just had not gotten around to it because their CVSS-based priority queue had other things ranked higher.

In my opinion, what should actually drive your prioritisation is exploitation intelligence. Whether something is being actively exploited right now, what the statistical probability of exploitation is over the 30 days, whether CISA has flagged it as a known exploited vulnerability. Those signals tell you what is operationally dangerous rather than just theoretically severe.

EPSS, the Exploit Prediction Scoring System maintained by FIRST, assigns a probability score between 0 and 1 to every published CVE based on real world threat data. It is telling you the likelihood of exploitation in the 30 days. Research has shown that using an EPSS threshold strategy lets you patch fewer total vulnerabilities while still catching significantly more of the ones that actually get exploited, compared to a blanket “fix all highs and criticals” approach.

CISA’s Known Exploited Vulnerabilities catalog is the other big one. If a CVE is on the KEV list, someone is actively using it against real targets. Federal agencies have mandatory remediation timelines for KEV entries under BOD 22–01. But the KEV only covers 0.5% of all published CVEs so while it is the most reliable signal available, it is not going to cover everything.

Even combining EPSS and KEV still does not give you the whole picture though. A vulnerability might score high on EPSS but if it only affects an internal development server that is completely disconnected from everything else, maybe it can wait. The criticality of the asset, whether it faces the internet, what role it plays in your operations, all of that context should factor into how urgently you respond. And most vulnerability management workflows just do not account for it in any structured way.

The big enterprise security platforms have moved well beyond CVSS at this point. There are products now that do reachability analysis, meaning they look at your actual firewalls, EDR, and network paths to determine whether a vulnerability is even exploitable in your specific environment. There are agentic AI tools that autonomously validate scanner findings and can take a list of 200 critical alerts and tell you that only two of them are actually exploitable. There are full exposure management platforms that combine all of this with compensating control analysis and automated remediation workflows.

These tools genuinely work and they represent where the industry is heading. But they come with enterprise pricing, they need deep integration into your infrastructure, and the deployment complexity puts them out of reach for the majority of security teams. If you are a smaller organisation, a startup, an MSP, a university, or even a mid-size company that does not have a six figure budget for vulnerability management tooling, you are mostly still looking at CVSS scores in a spreadsheet and making judgment calls.

CISA developed something called SSVC, Stakeholder Specific Vulnerability Categorization, and it approaches the prioritisation problem in a fundamentally different way. Instead of giving you a severity score and leaving you to interpret what to do with it, SSVC walks through a decision tree that considers exploitation status, whether the vulnerability could be exploited at scale automatically, the technical impact, and how critical the affected system is to your organisation.

What comes out the other end is not a number, it is a decision. Act means drop everything and fix this immediately. Attend means fix it sooner than your normal cycle. Track* means watch it closely because it could escalate. Track means handle it during your normal patching window.

CISA is actively encouraging every organisation to adopt this kind of decision framework, and FIRST is pushing in the same direction. The enterprise tools are starting to bake SSVC concepts into their products. But in the open-source world and for smaller teams, there is basically nothing that takes scanner output, enriches it with EPSS and KEV data, runs it through an SSVC decision tree, and presents the results in a way that both the analyst and the executive can use.

The framework exists on paper. The data sources are free and publicly available. The enterprise market has proven the approach works. But the practical, accessible tooling that brings all of this together for teams that do not have massive budgets? That is still a gap.

I have spent months doing this work. Running scans, triaging findings, building remediation reports, and dealing with the frustration of knowing that better frameworks exist while the tools to actually use them do not. I have felt this problem from the inside and I understand where the friction is.

I am building something to close that gap. More on that soon.

If you are dealing with the same thing in your own environment I would genuinely like to hear how you handle it. Connect with me, I will be sharing more this over the coming weeks.