AI Vulnerability
Prioritisation:
EPSS + LLM Context = Real Risk.

The CVSS Problem

CVSS (Common Vulnerability Scoring System) measures theoretical severity — the worst-case impact if a vulnerability is exploited in an ideal attack scenario. It does not measure the probability of exploitation. A CVSS 9.8 vulnerability in a library that is never called from an internet-facing code path is much less urgent than a CVSS 7.2 vulnerability in a function that processes untrusted input on every API call.

Organisations that prioritise by CVSS alone spend most of their remediation budget on vulnerabilities that will never be exploited while ignoring lower-scored vulnerabilities that are actively being exploited in the wild.

EPSS: Exploitation Probability

EPSS (Exploit Prediction Scoring System) is a machine learning model maintained by FIRST that predicts the probability that a given CVE will be exploited in the wild within the next 30 days. It is trained on threat intelligence feeds, exploit databases, and observed attack data.

Key characteristics of EPSS:

• Scores range from 0 to 1 (probability of exploitation in 30 days)
• Updated daily as new threat intelligence arrives
• Median EPSS score for critical-rated CVEs is approximately 0.03 (3%) — most are never exploited
• EPSS ≥ 0.4 correlates strongly with active exploitation within 30 days

Using EPSS alongside CVSS dramatically focuses remediation: fix high-CVSS + high-EPSS first, defer high-CVSS + low-EPSS unless you have capacity.

LLM Codebase Context

Even EPSS doesn't account for your specific environment. A vulnerability with EPSS 0.5 in a library you use only in a background batch job with no external inputs is lower risk than the same vulnerability in a library called directly from your public API.

LLMs can analyse the reachability of a vulnerable function within your specific codebase:

• Is the vulnerable function reachable from an internet-facing entry point?
• Does the call path pass through authentication and authorisation checks?
• Is the input to the vulnerable function user-controlled or internal-only?
• Is there compensating control (WAF, rate limiting, input validation) upstream?

This context-aware reachability score is the third dimension that CVSS and EPSS cannot provide.

The Combined Risk Score

A practical combined risk score formula:

Risk = CVSS_normalised × EPSS × Reachability_factor × Business_impact

• CVSS_normalised = CVSS score / 10 (0-1 range)
• EPSS = raw EPSS probability (0-1)
• Reachability_factor = 1.0 (internet-facing, no auth), 0.7 (authenticated but reachable), 0.3 (internal only), 0.1 (unreachable in current code)
• Business_impact = multiplier based on the affected service's criticality (2.0 for payment processing, 1.5 for auth, 1.0 for standard services)

Practical Triage Model

Combined Score	SLA	Remediation Track
>0.4	24 hours	Emergency response, CISO notification
0.2 – 0.4	7 days	Priority sprint item, security team involvement
0.05 – 0.2	30 days	Standard sprint item, auto-fix candidate
0.01 – 0.05	90 days	Backlog, auto-fix if feasible
<0.01	Accept risk	Monitor, defer indefinitely