Units
1. Introduction to Artificial Intelligence in Cybersecurity: Roles, Boundaries, Defense Ethics and Verification 2. Log and SIEM Analysis: Separating Event from Noise with Artificial Intelligence 3. Threat Hunting: Establishing Hypotheses and Searching for Signals with Artificial Intelligence 4. Vulnerability Scanning and Prioritization: Sorting Correctly with CVE, CVSS, EPSS and Context 5. Incident Response: Rapid Analysis, Playbook and Controlled Decision with Artificial Intelligence 6. Phishing and Social Engineering Analysis: Email, URL and Header Review 7. Secure Code Review and Static Analysis: Finding Vulnerabilities with Artificial Intelligence 8. Threat Intelligence: IOC, TTP, MITER ATT&CK and Sensemaking with Artificial Intelligence 9. Reporting and Communication: From Findings to Technical Reports to Executive Summary 10. Boundaries, Privacy, Ethics and Unauthorized Use Prohibition 11. End-to-End SOC Workflow, Automation (SOAR), Quality Management and Self-Audit
Unit 4 / 11

Vulnerability Scanning and Prioritization: Sorting Correctly with CVE, CVSS, EPSS and Context

Gains:

  • Ability to prioritize accurately by combining CVSS (severity), EPSS (likelihood of abuse) and KEV (actual abuse) with the institutional context (exposure, criticality, compensatory control)
  • Ability to verify the CVE numbers and scores that artificial intelligence can create in NVD/EPSS/KEV sources and pass the patching plan through the change management gate
  • Understand that high CVSS alone does not mean priority, but that real risk is determined by context.

There are thousands of vulnerabilities in every organization: a vulnerability in a software, a misconfiguration, or an outdated component that an attacker can exploit. A vulnerability scanner—a tool that scans systems and lists known vulnerabilities—easily yields 10,000-50,000 findings in a medium-sized organization. The problem is not finding them; In this pile where it is impossible to close them all at the same time, it is important to decide which one to patch first. Wrong prioritization causes harm in two ways: you delay what is truly dangerous, or you exhaust the team and business continuity over thousands of unimportant findings.

Artificial intelligence is a powerful aid in this prioritization. It can group thousands of lines of scan output, combine duplicates, translate each finding into human language, explain “why is this important,” and provide a prioritization outline. But AI does not know which server in your organization is open to the internet and which holds critical data; and most dangerously, it can fabricate a vulnerability identity (CVE) that does not exist. So the AI ​​generates and explains the ranking outline, but the final priority decision is made by the analyst with the institutional context and validated data.

Basic concepts of prioritization

Let's clarify a few terms. CVE (Common Vulnerabilities and Exposures) is the unique ID given to each known vulnerability (e.g. CVE-2021-44228, infamous Log4Shell). CVSS (Common Vulnerability Scoring System) is the standard that scores the technical severity of a vulnerability from 0 to 10; 9.0+ is considered "critical". But CVSS alone is not enough because it says "how serious it might be", not "how likely it is that it will actually be abused". This is where EPSS (Exploit Prediction Scoring System) comes in: it predicts the likelihood that a vulnerability will actually be exploited in the next 30 days. There is also the KEV (Known Exploited Vulnerabilities) list: vulnerabilities that have been proven to be used in actual attacks; These are absolute priority.

Proper prioritization combines these three and the enterprise context: high CVSS + high EPSS + on KEV list + critical server open to the internet = patch immediately. High CVSS but low EPSS + on internal network + restricted access = scheduled patching.

Table of prioritization factors

factor

what does it say

Source

Is it enough alone?

CVSS score

Technical seriousness (0-10)

NVD / vendor

No — it doesn't say probability

EPSS score

Probability of being exploited (%)

FIRST.org

No — the context doesn't say

KEV list

Is it actually being exploited?

CISA KEV

Strong signal, not the only one

Asset criticality

How valuable is the server?

Institutional inventory

Provides context

exposure

Is it open to the internet or isolated?

network architecture

Provides context

compensatory control

WAF, is there segmentation?

Institution information

Reduces risk

AI is quick to fill in this table; But it is your responsibility to confirm the CVSS/EPSS/KEV values ​​from the official source and add the asset criticality and exposure with institutional knowledge.

Vulnerability prioritization steps

  1. Collect and anonymize scan output. Mask internal hostnames and IPs.
  2. Group and reduce repetition. Let AI combine the repetitions of the same vulnerability on different machines and create a unique CVE list.
  3. Enrich. Include CVSS, EPSS, and KEV status for each CVE — but verify them from the official source.
  4. Add context. Which system is open to the internet, which holds critical data, which compensating control exists — you add it up.
  5. Sort by. Have a priority list drawn up that combines seriousness + likelihood + context.
  6. Verify and decide. Confirm that the CVEs of the above findings are genuine and that the versions actually exist in your institution; Approve the patching plan as an analyst.

three mini cases

Case 1 — 12,000 findings, 40 real priorities. An analyst gives anonymized 12,000 lines of scan output to the AI. AI combines the repetitions and reduces them to 380 unique CVEs, enriches them with EPSS and KEV data, and highlights "40 vulnerabilities that are on the KEV list and located on the server open to the internet." The analyst confirms these 40 CVEs in NVD and the KEV catalog, patching the 3 critical vulnerabilities that actually exist within 24 hours. The stack has shrunk from 12,000 to a manageable 40; The analyst made the decision.

Case 2 — Fake CVE. Another analyst has the AI ​​prioritize; AI says "CVE-2023-88888, CVSS 9.8, patch now." Analyst searches for this number in NVD — no record, model made up. If it hadn't been confirmed, the team would have been looking for a patch that didn't exist. Lesson: not every CVE number gets prioritized until it is verified in the NVD/vendor registry.

Case 3 — CVSS is high but risk is low. A scanner finds a CVSS 9.1 vulnerability on a test server on the internal network. AI puts this first. But the analyst adds context: the server is closed to the internet, there is no critical data, there is network segmentation in front of it, and the EPSS score is 0.4%. In the same list, there is another vulnerability that is CVSS 7.5 but is open to the internet and is in KEV. The analyst corrects the ranking: The vulnerability in KEV, with low CVSS but actually being exploited, comes first. Lesson: CVSS alone is not a priority; context determines.

Weak prompt / Strong prompt

Weak prompt:

Rank these vulnerabilities from most dangerous to most dangerous and write their CVSS scores. [scan output]

This claim relies solely on CVSS (ignoring probability and context), leaves the door open for AI to fit CVSS/CVE values, and does not take into account agency exposure.

Powerful prompt:

Your role: prioritization DRAFT assistant to the security analyst.Decision making; Don't order patching. Process the following anonymous scan output:(1) merge duplicates, output unique CVE list,(2) populate CVSS, EPSS and KEV status for each CVE BUT mark each value as "[Must be verified from NVD/EPSS/KEV]"; Don't make up any values, write "[unknown]" if you are unsure, (3) write me 3 questions I should ask for the institutional context (exposure, asset criticality, compensatory control), (4) provide a PRELIMINARY ranking based on technical data only, state that I will correct it with the enterprise context. Output: [anonymous scan result]

The powerful prompt asks for the CVSS/EPSS/KEV trio, leaves each value to be verified, takes the institutional context from you, and gives you the final decision.

Copiable prompt templates

VULNERABILITY GROUPING TEMPLATE Process the following anonymous scan output: (1) combine occurrences of the same CVE across different machines, (2) extract the unique CVE and number of affected machines, (3) group by product/component. Don't make up any CVE numbers; don't add something that isn't in the source. Output: [paste]

TRIPLE ENRICHMENT TEMPLATE For the CVE list, add CVSS base score, EPSS probability, and whether it is on the KEVlist in each line. export EVERY value with "[verify: source]" flag; Presenting accurate data, fabrication. Type "[confirm in NVD]" for the CVE you are unsure of. CVEs: [paste]

CONTEXT QUESTION TEMPLATEFor the following priority vulnerabilities, generate the questions you need to ask me about the organization context so that I can rank them correctly: exposure (is it open to the internet), asset criticality, data sensitivity, compensatory controls, patch window. I will give the answers; You update the ranking only after that. Vulnerabilities: [paste]

PATCH PLAN DRAFT TEMPLATEDRAFT a patching plan based on the validated priority list and the context I provide: immediate (24h), short-term (7d), planned (30d) buckets; justification for each vulnerability and potential business impact/outage risk. This is a draft; approval and implementation belongs to the analyst and change management. Data: [paste]

Common mistakes

  • Just looking at CVSS. High CVSS may indicate low actual risk; Consider EPSS (probability), KEV (actual exploitation) and context together.
  • Not verifying CVE. Non-AI can make up CVE numbers and scores; confirm each with NVD/dealer registration.
  • Bypassing the institutional context. Is it open to the Internet, is there critical data, is there compensatory control — these completely change the ranking.
  • Assuming version matching. The browser sometimes reads the wrong version; Verify that the vulnerability actually exists in your organization (false positive scan).
  • Implementing the patch plan alone without business impact. A critical patch can cause business interruption; Change management and testing are essential.
Tip: The golden combination in prioritization is "KEV listed + open to the internet + high EPSS". If these three intersect, that vulnerability goes to the top of the list regardless of CVSS.
Caution: Declaring a vulnerability as "critical" and patching it immediately can also be risky; An untested patch can crash production. The plan the AI ​​produces is a blueprint; implementation goes through the change management process and testing gate.

In summary

The difficult part of vulnerability management is not finding it, but highlighting the correct one among thousands of findings. The AI ​​groups the scan output, reduces repetition, translates it into human language, and provides a ranking outline. But proper priority does not come from a single number: CVSS (severity), EPSS (likelihood), KEV (actual exploitation) and institutional context (exposure, criticality, compensatory control) are evaluated together. The most dangerous mistake of AI is non-CVE and score fabrication; so each value is validated in NVD/EPSS/KEV, the enterprise context is added by you, and the patching plan goes through the change management gate.

Application task

Get a sample scan output (anonymized from yourself or from sample data). Extract unique CVE list and CVSS/EPSS/KEV outline from AI with “Vulnerability Grouping” and “Triple Enrichment” templates. Verify the top 5 CVEs yourself in the NVD and CISA KEV catalogue; Try to catch at least one fictitious or false value. Then answer the questions in the "Context Question" template for your environment and note how the order changes.

checklist

  • [ ] I anonymized the scan output; host and IP are masked.
  • [ ] I combined the duplicates to get a list of unique CVEs.
  • [ ] I verified each CVE and CVSS/EPSS/KEV value in the official source.
  • [ ] Knowing that it might be fake or wrong CVE/score, I confirmed it.
  • [ ] I included the institutional context (exposure, criticality, compensatory control) in the ranking.
  • [ ] Not just CVSS; I also looked at EPSS and KEV.
  • [ ] I treated the patch plan as a draft; I added the testing and change management door.
Previous Next