Understanding vulnerabilities, without the jargon
Four acronyms are enough to triage any security alert. CVE tells you which flaw you're dealing with. CVSS tells you how much damage it could do. EPSS tells you how likely it is to be exploited. KEV tells you whether it already is. From the most theoretical to the most certain.
On a Friday evening you get an alert: “CVSS 9.8, critical.” Should you cancel your weekend? These four guides give you what you need to decide in thirty seconds — and to defend that decision in Monday's meeting.
Where to start: the reading order
Read them in this order. Each one builds on the previous one, and none takes more than eight minutes.
- CVE first, because it's the number everything else hangs on. Without it, two tools can't be sure they mean the same flaw.
- CVSS next, because it's the number you'll see everywhere — and the one most often misread.
- EPSS third, because it fixes the main weakness of CVSS: severity is not probability.
- The KEV last, because it's the only one of the four that predicts nothing: it observes. Once you understand that, prioritization becomes simple.
The four frameworks, side by side
Here is the table that makes it all click: these four frameworks don't answer the same question, aren't published by the same organizations, and don't age at the same pace.
| Standard | Question it answers | Type of answer | Who publishes it | Changes? |
|---|---|---|---|---|
| CVE | Which flaw are we talking about? | An identifier | The CVE Program (MITRE), through each CNA | Its status, never its number |
| CVSS | How much damage if it is exploited? | A score from 0 to 10 | FIRST, applied by the NVD and CNAs | No, for the base score |
| EPSS | How likely is it to be exploited within 30 days? | A probability from 0 to 1 | FIRST | Yes, recalculated daily |
| KEV | Is it being exploited right now? | An observed fact: yes or no | CISA | Yes, through successive additions |
What you'll be able to do afterward
- Read a CVSS vector field by field and say out loud what it describes.
- Tell the EPSS score (a probability) from its percentile (a ranking) — the most common confusion about this framework.
- Explain in one sentence why one CVE in your environment goes ahead of another.
- Spot an unusable alert: a CVE with no affected version cannot be matched against any inventory, by any tool.
The frameworks around CVEs
Once you have the four basics, three taxonomies complete the picture: CWE names the type of defect behind the flaw, CAPEC describes how it is exploited, and CNA are the organizations that assign identifiers — and so, in practice, determine the quality of your alerts. Our data sources detail the feeds we cross-check.