Skip to content
VOC.

04 · VOC area

Prioritization

Severity is not risk. This area explains what CVSS v4 does and does not tell you, how EPSS and the CISA KEV catalog add exploitation evidence, how SSVC turns it all into decisions, and how to build priority tiers your remediation teams can actually meet.

Guides in this area

  1. Risk-based prioritization with CVSS v4, EPSS and KEV

    How to combine CVSS v4 severity, EPSS exploitation probability, the CISA KEV catalog and asset context into priority tiers teams can meet.

  2. SSVC: vulnerability decision trees for a VOC

    How Stakeholder-Specific Vulnerability Categorization (SSVC) works, how to evaluate each decision point, and how to map Track, Attend and Act to SLAs.