Prioritization Myths Busted with Better Vulnerability Data

The speaker, a data scientist at a vulnerability intelligence company, opens with a lunch-picking analogy to frame prioritization as sorting and filtering options against a goal or constraint. For vulnerabilities, he argues the core aim is avoiding exploitation. He notes that the gap between disclosure and public exploit keeps shrinking, and that the NVD has stopped supplying the metadata teams need to rank flaws.

He then compares scoring approaches. EPSS estimates exploitation likelihood and performs well, but its latest model is effectively a black box that cannot be audited or easily explained. CVSS is transparent and flexible, yet its highest bands hold roughly as many vulnerabilities as teams can realistically fix, so it does not order the top group. He warns that signals such as KEV listing, social attention and EPSS can reinforce one another, inflating a single flaw's prominence. His proposal is to rank available metadata by importance, then keep the vulnerabilities that are not outclassed on the most important factors, using Pareto-style tiers that combine transparent and complex scores.

In the question period the discussion moved to the number of affected systems, unreliable CPE naming, and reputational or political pressure that can override scores. The takeaways are to combine several signals, be skeptical of unanimous agreement, and invest in knowing your assets.