CTEM Prioritization: How to Combine KEV, EPSS, CVSS and Business Impact

• Why severity alone produces an unworkable queue
• What each prioritization signal really tells you
• A worked example of four findings ranked correctly
• How to build a weighting model and publish it
• How reachability and validation change the ranking
• How to keep the model honest over time

Why severity alone produces an unworkable queue

If you sort by CVSS, a large enterprise queue will contain tens of thousands of critical and high items, most of which no attacker will ever touch. Severity describes what a flaw could do under ideal conditions for the attacker. It says nothing about whether anyone is exploiting it, whether the affected service is reachable, or whether the asset matters to the business.

The practical consequence is credibility loss. Engineering teams receive a list they cannot finish, notice that yesterday's critical item is unchanged today, and start treating the entire queue as advisory. Prioritization exists to prevent that outcome.

What each signal actually tells you

A worked example

Four findings arrive in the same cycle. Sorted by CVSS, the ordering would be A, B, C, D. Sorted by the CTEM model, the ordering changes completely, and the change is defensible to both the CISO and the platform team.

Notice that C outranks D despite a much lower CVSS score. A publicly readable bucket holding regulated records needs no exploit chain at all, which is a case where severity scoring is structurally misleading because there is no software vulnerability to score.

Building a weighting model you can defend

1. 1Start with hard triggers. Known exploited plus reachable plus critical asset always enters the top tier, regardless of any score.
2. 2Use EPSS with a threshold, for example 0.1 or higher, rather than as a fine grained ranking number.
3. 3Apply asset tier as a multiplier that the business owns and reviews quarterly.
4. 4Use CVSS as a floor to filter noise, not as the primary sort key.
5. 5Downgrade only on validated control effectiveness, never on an assumption.
6. 6Publish the model in one page and review it after every major incident or near miss.

Reachability is the cheapest large win

Most teams can cut their actionable queue substantially by asking one question consistently: can an attacker reach this from anywhere they can plausibly stand. Internet exposure, identity reachability and network path data all contribute. Reachability is also easier to automate than validation, so it is the right filter to add first if your programme is early.

Keeping the model honest

• Sample the queue monthly and ask whether the top ten items still feel right to a senior analyst
• Track how often validation overturns a ranking, which tells you where the model is weak
• Re-collect asset criticality from business owners on a fixed schedule
• Watch for score inflation, where teams request a tier upgrade to get work scheduled
• Record every exception with an expiry so accepted risk stays visible

How this fits the CTEM lifecycle

Prioritization sits between discovery and validation. It receives everything discovery found and produces a short ranked queue that validation can realistically test. If prioritization is weak, validation wastes its budget and mobilization loses the trust of engineering teams. If it is strong, the rest of the loop becomes much cheaper.

How to measure success

• Write your prioritization model on one page and circulate it to engineering leadership.
• Add hard triggers for known exploited vulnerabilities on reachable critical assets.
• Introduce a reachability filter before investing in heavier validation tooling.
• Collect asset criticality from business owners and refresh it quarterly.
• Track how often validation overturns the ranking and tune the weights accordingly.
• Cap the top tier at what your teams can actually remediate in one cycle.

• Sorting by CVSS and calling it risk based prioritization.
• Using EPSS as a precise ranking number rather than a threshold.
• Treating the KEV catalog as complete rather than as a floor of confirmed exploitation.
• Letting asset criticality be assigned by the security team without business input.
• Producing a top tier larger than remediation capacity, which restores the original problem.
• Hiding the model, which guarantees the queue gets renegotiated in every meeting.