A link does not tell the whole threat story
A report’s “exploit” column sometimes contains a link and sometimes is empty. A link may lead to analysis, a partial demonstration or a report of exploitation. An empty field may simply mean the source supplied nothing by the collection date. Neither state is enough to classify a case.
Before changing priority, establish what the reference demonstrates and whether its conditions apply to your system. Exploitation documented elsewhere does not prove compromise of your systems. Nor does an absence of public references rule out an applicable vulnerability. The decision depends on evidence strength and your technical situation.
Name the evidence level precisely
A proof of concept demonstrates feasibility under particular conditions. A public exploit may be more developed, but can also be incomplete or configuration-specific. Observed exploitation requires evidence of real use. CISA’s SSVC guide distinguishes public proofs of concept from active exploitation. These levels deserve separate fields in the case file.
For every reference, record the author, date, versions, prerequisites and stated limitations. Check whether other publications add independent evidence or repeat the same announcement. Teams can then understand the conclusion without repeating the research.
KEV provides an important signal, not a description of your estate
CISA’s Known Exploited Vulnerabilities catalogue lists vulnerabilities known to have been exploited. Its data is also available in the official cisagov/kev-data repository. Retain the identifier, date added and access date so a later review can establish what was known at the initial decision.
A KEV entry strengthens the threat signal. It confirms neither software presence nor local applicability. Absence from the catalogue does not exclude exploitation. Check the applicability of its listed deadlines before adopting them as your own commitments or treatment dates.
Sources: CISA: official KEV data repository, CISA: When to Issue VEX Information
EPSS estimates probability; it does not observe an attack
FIRST’s EPSS estimates the probability that a published CVE will be exploited in the wild within the next thirty days. The score is dated and does not directly describe your service’s exposure. Its percentile expresses relative rank among scores, not a second probability.
A low score does not negate documented exploitation; a high score does not confirm local applicability. Use EPSS alongside other case information. CVSS describes severity, while EPSS forecasts exploitation. The rule leading to your priority should explain each input’s role.
Sources: FIRST: Exploit Prediction Scoring System, FIRST: EPSS data and percentile definition
Two fictional cases, two different investigations
DEMO-MENACE-A has a public demonstration for a component confirmed in the service, without observed exploitation. The team verifies prerequisites and prepares treatment. DEMO-MENACE-B has a vendor advisory reporting observed exploitation, but the installed version is missing.
For B, obtaining the version becomes an urgent, assigned and dated action. Threat information accelerates verification without resolving applicability on its own. For A, confirmed local conditions may justify high priority even without a catalogue entry. Each decision retains its rationale and potential revision triggers.
Keep an updateable summary
The summary retains reference type, documented exploitation and date, applicability, exposure and the decision. An updated advisory, catalogue addition or newly collected version can restart analysis. History explains why priority changed.
Entrust CyberLifeCycle with monitoring and assessment of exploitation information for your scope. We connect sources, document evidence levels and track required checks. Retrieve a dated analysis for decisions without repeating research before every review.
Sources consulted
- CISA: SSVC guide and exploitation levelsAccessed on 30 October 2026.
- CISA: official KEV data repositoryAccessed on 30 October 2026.
- CISA: When to Issue VEX InformationAccessed on 30 October 2026.
- FIRST: Exploit Prediction Scoring SystemAccessed on 30 October 2026.
- FIRST: EPSS data and percentile definitionAccessed on 30 October 2026.