Blog · Section

Prioritization

Deciding what to fix first: CVSS, EPSS and KEV, reachability and impact, and why a severity score on its own is not a measure of risk.

1 article·Last published November 3, 2026

Latest·Prioritization

CVSS, EPSS and KEV: why a score is not a risk

Three signals, three different questions. Where each one helps, where each one misleads, and why none of them can tell you whether a vulnerability is exploitable in your environment.

November 3, 2026·7 min read

Read the article

Early access

See your exposure the way an attacker does.

We are onboarding a small number of teams. Tell us about your environment and we will get back within two business days.

Get early access Sign in