Verizon DBIR

Out of 48,000 Vulnerabilities Only 1% Are Dangerous: How to Find Them Using CVSS 4.0, EPSS, KEV and FSTEC Methodology

The article explains why prioritizing vulnerabilities is critical in 2025-2026 as exploitation became the top initial access vector for the first time in 19 years according to Verizon DBIR. It details the limitations of CVSS scoring alone, the shift to CVSS 4.0 with new metrics like Attack Requirements and Supplemental Metrics, and the impact of NIST reducing NVD enrichment to only actively exploited or federal software cases. EPSS provides daily exploitation probability predictions using machine learning on over 1,100 features, while CISA KEV and the new LEV metric help identify confirmed or likely exploited vulnerabilities. The text covers practical prioritization criteria including asset significance, exploit availability, and network exposure, plus challenges for Russian infrastructure due to CVE dependency. It also compares CISA KEV with commercial catalogs like VulnCheck KEV that detect exploitation earlier.

Vulnaware Bridges Vulnerability Scanners and ITSM Systems to Improve Critical Flaw Prioritization

A new open-source tool called Vulnaware has been developed to address the persistent gap between vulnerability discovery and remediation in enterprise environments. The project focuses on intelligent prioritization rather than attempting to fix every reported CVE, recognizing that fewer than 10 percent of published vulnerabilities are ever exploited. It integrates outputs from MaxPatrol VM, Nessus Pro, and Greenbone/OpenVAS, then applies scoring based on CISA KEV catalog presence, public exploit availability from Vulncheck feeds, and trend data. Prioritized issues are automatically converted into tickets in Jira Service Management, GLPI, Znuny, and osTicket, while also delivering alerts via Telegram and email. The approach aligns with the updated CISA BOD 26-04 framework that replaced flat 15- and 25-day deadlines with risk-based timelines of 3, 14, or 60 days. By treating vulnerability remediation as a managed change or service request under ITIL4 principles, Vulnaware ensures that critical issues reach the correct engineering teams with proper SLA tracking.