How to decide which CVEs to patch first with KEV and EPSS (spreadsheet)
Short answer
Patch in this order: vulnerabilities in CISA's KEV catalog first (they are being exploited), then high EPSS scores (likely to be exploited soon), then severity (CVSS) and how exposed the system is. Paste your scanner's CVE list into a sheet, look each up in KEV and EPSS, and sort.
- Export CVE ids from your scanner.
- Mark each CVE that is in CISA KEV (and its due date).
- Add the EPSS score from FIRST.
- Sort: KEV first, then EPSS, then CVSS and internet exposure.
Kevscope Patch Playbook + Prioritizer: Patch what attackers actually exploit
from $19The Kevscope Patch Playbook ($19) is a 6-page KEV + EPSS playbook plus a workbook that looks up up to 2,000 of your CVEs in the bundled KEV catalog.
Secure checkout · 14-day fix-or-refund if it doesn't work as described (terms)Questions
Why not sort by CVSS only?
Most high-CVSS vulnerabilities are never exploited; KEV and EPSS show which ones are.
Free: the Small Business Starter Kit
Bookkeeping and profit previews plus free invoice, rent receipt, margin and HACCP/allergen tools, then 5 short emails on margins, invoicing and checklists.