I Built a Vulnerability Triage Tool Without Knowing What EPSS or KEV Meant

Description and use

triage‑lens prioritizes CVEs using EPSS, CISA KEV, and CVSS, producing a concise actionable list for security teams.

Problem

Security teams receive long lists of CVEs with high CVSS scores but lack guidance on which to address first, leading to wasted effort.

Outcome

The tool reduced the actionable CVE list to a short, high‑confidence set, enabling faster remediation decisions.

Workflow

• Collect CVE list from vulnerability scanner
• Fetch EPSS scores via FIRST.org API
• Download CISA KEV catalog
• Assign priority: P0 if in KEV, P1 if EPSS≥0.1 and CVSS≥7.0, else lower
• Generate ranked report for the team

Evidence

The top rank P0 means listed in KEV: it already rained there, no debate.

Source

The three P0 findings (Log4Shell, Heartbleed, Spring4Shell) were really listed.

Source