Risk-based prioritisation: CVSS v4, EPSS, KEV, SSVC
You learn to pick what really matters out of thousands of findings, deciding by combining scores, exploitation likelihood, actively exploited lists and asset importance.
Level 301 · 15 lessons · 15 practice labs
Lessons
Scores
- CVSS v4 in depth: base, threat and environmental metrics
- Rescoring for your organisation with environmental metrics
- EPSS: exploitation probability
- Catalogues of actively exploited vulnerabilities
- Short task: rank two vulnerabilities with the same CVSS score using EPSS and KEV
Decision
- SSVC decision trees
- Asset criticality and exposure
- Reachability: does the vulnerable code actually run
- Public exploit code and its maturity
- Short task: sort twenty findings into four groups with SSVC
Applying it
- Writing a prioritisation script in Python
- Explaining risk to a non-technical audience
- Remediation deadlines by priority
- Risk acceptance and time-limited exceptions
- Capstone: reduce a 3,000-finding report to 20 jobs for the first week
Practice labs
- Interpret the base score from a CVSS v4 vector: Read each metric in the vector and write down which value raises the score most.
- Rescore for your organisation with environmental metrics: Enter environmental values for an isolated, low-criticality server and justify the new score.
- Show why one flaw scores differently on two servers: Score one flaw separately for a payment server and a test server and explain the gap through the metrics.
- Rank two flaws with the same CVSS score using EPSS: Find both flaws’ probability in the offline EPSS data and write which one to close first.
- Flag the findings that are in the KEV catalogue: Match scan findings with the actively exploited catalogue and list the matches with their due dates.
- Separate high-score flaws with low exploitation probability: Split 200 findings into four quadrants by CVSS and EPSS and identify the quadrant to handle first.
- Assess the maturity of public exploit code: Review exploit records for three flaws and distinguish proof of concept from weaponised code.
- Walk the SSVC tree for a single flaw: Answer the exploitation, exposure and impact questions and write down the resulting decision.
- Sort twenty findings into four groups with SSVC: Run each finding through the decision tree and place it in the act, attend, track closely or track group.
- Check whether the vulnerable code actually runs: Check whether the vulnerable function in a dependency is called in the app and lower the priority accordingly.
- Write a prioritisation script in Python: Write a script combining CVSS, EPSS, KEV and asset criticality into a ranked list and run it on sample data.
- Reduce a 500-finding report to ten jobs for week one: Group findings by root cause, prioritise them and choose the jobs where one patch closes the most findings.
- Write a risk acceptance with a time limit and justification: Prepare an exception record with owner, compensating control and end date for a flaw that cannot be patched.
- Separate the findings on internet-facing assets: Match the findings list against the asset inventory and move findings on externally reachable servers to a separate list.
- Compare fix, mitigate and accept for the same finding: Score the three options on patch downtime, compensating control and residual risk, decide with KEV and EPSS data in mind and write your reasoning for the approver.
About this course
You learn to pick what really matters out of thousands of findings, deciding by combining scores, exploitation likelihood, actively exploited lists and asset importance.
What you will learn
- Scores
- Decision
- Applying it
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.