Rewriting the Playbook: Smarter Vulnerability Management with EPSSv3, CVSSv4, SSVC & VEX Frameworks

The talk, given by Avinash Nutalapati, starts from the limits of relying on CVSS version 3 scores alone. A severity number says little about reachability in a given environment, exploits often appear long after disclosure, and attackers chain weaknesses rather than using one bug. CVSS version 4 adds attack requirements, user interaction and downstream impact.

The middle section covers three complementary frameworks. EPSS, a model from FIRST, estimates the chance of exploitation within 30 days and is refreshed daily, so it sets the order of work, though low scores should not be dismissed outright. VEX records whether a vendor component is actually affected, with outcomes such as not affected, fixed and under investigation. SSVC, developed at Carnegie Mellon and adapted by CISA, is a decision tree ending in track, attend or act, and should be customized for sectors such as finance or healthcare.

The closing part proposes a phased rollout: EPSS and KEV data first, then SBOM pilots, CVSS 4 and VEX work, and SSVC last, with automation of tagging and ticket creation throughout. Practitioners need skilled staff and suitable tooling, and should ask vendors for SBOMs, since a clean internal result does not mean a supplier is unaffected.