Application Security
Prioritizing Risk
Why CVSS Score Alone is Insufficient #
CVSS describes theoretical severity - how bad a vulnerability could be in the abstract. It does not tell you whether a public exploit exists, whether malicious activity has been observed, or whether the weakness is reachable in your running services.
Splunk Secure Application adds EPSS Risk Score - threat telemetry combining base CVSS with real-world signals such as exploit availability and observed activity. Operational risk assessment & triage should use both scores, not CVSS alone.
Compare High CVSS, Low Risk Score #
Exercise
- Locate a vulnerability with a high CVSS score and a low EPSS Risk Score.
- Review any indicators suggesting whether or not there has been any active exploit context.
Knowledge Check #
Why might a team safely deprioritize this item despite high theoretical severity?
Compare High CVSS, High Risk Score #
Exercise
- Locate a vulnerability with high CVSS and high Security Risk Score.
- Check for a “vulnerability reached” or similar indicator showing an exploit against this CVE.
Knowledge Check #
Why does this item warrant prioritize-first treatment?
What you learned #
- How CVSS and Threat Risk Score differ in operational triage.
- How to identify deprioritize-safe versus prioritize-first findings.
- How exploit-reach indicators connect cataloged CVEs to active risk.