CVSS vs EPSS
Severity scoring against probability of exploitation: what CVSS v4.0 and EPSS each measure, update frequency, why a critical CVSS score with a tiny EPSS probability may wait, and a simple rule for combining both in a remediation SLA.
Vulnerability prioritization for test findings
Comparisons of the scoring systems and catalogs used to rank vulnerability scan and penetration test findings: CVSS versions, EPSS, the CISA KEV catalog and SSVC decision trees.
CVSS v3.1 vs CVSS v4.0
What changed in CVSS v4.0: the Threat group replacing Temporal, the Supplemental group, CVSS-B and CVSS-BTE nomenclature, and what a penetration test report and a vulnerability management policy should say about which version they use.
EPSS vs CISA KEV
A daily probability forecast for every CVE against a curated list of vulnerabilities with confirmed exploitation: inclusion criteria, coverage, federal remediation duties under BOD 26-04, and how to use KEV as a floor and EPSS as a ranking.
SSVC vs CVSS
A decision tree that outputs an action (Track, Attend, Act) against a numeric severity score: decision points, who created SSVC, where CVSS feeds the tree, and when a small team is better served by SSVC outcomes than by score thresholds.
