#Vulnerability prioritization

EPSS: the probability of vulnerability exploitation in your patch queue

A patch queue sorted by CVSS shows what would be most dangerous, not what someone is actually exploiting. EPSS gives the probability that a vulnerability will be exploited within 30 days, but it only works when you read it as a probability, check it against the KEV catalog and confirm the vulnerability is even reachable in your company.