What vulnerability prioritization looks like when KEV, EPSS, and CVSS disagree
Cohesity field CISO Joye Purser ranks KEV over EPSS over CVSS and urges 24-72 hour patching of exploited internet-facing systems.
In a Help Net Security interview, Cohesity Global Field CISO Joye Purser lays out a vulnerability prioritization framework that puts active exploitation (KEV) first, then exploit likelihood (EPSS), then technical severity (CVSS), adjusted for asset exposure, business criticality, and compensating controls. She endorses 24-72 hour remediation targets for critical exploited internet-facing vulnerabilities and describes the organizational tradeoffs and emergency procedures needed to hit them. The interview also covers honeypot failure modes when deception systems are over-connected or over-trusted, and budget guidance recommending OT/IT segmentation, phishing-resistant MFA, and tested recovery for a 400-person manufacturer.
- Prioritization order: active exploitation (KEV), then exploit likelihood (EPSS), then technical severity (CVSS).
- Recommends 24-72 hour remediation for exploited internet-facing critical vulnerabilities.
- Warns honeypots become attacker footholds or compliance liabilities when over-connected.
- Urges phishing-resistant MFA, dormant account removal, and least privilege as high-value basics.
- Advises manufacturers to segment OT from IT and spend on identity and backup recovery.
- Vendors
- Cohesity
- Organizations
- CohesityHelp Net Security
From the original article
4 min read at helpnetsecurity.com
In this Help Net Security interview, Dr. Joye Purser, Global Field CISO at Cohesity , explains how to rank vulnerabilities when KEV, EPSS, and CVSS point in different directions. Active exploitation comes first, then exploit likelihood, then technical severity, with adjustments for asset exposure, business criticality, and compensating controls.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.