Skip to main content
Change Risk Intel
Tools & Comparisons

VPR vs EPSS vs CVSS: Which Score Should Drive Your CAB?

Ben Ennis Founder, Ennis Studio · former Partner Technology Advisor, ServiceNow · 11 min read

This comparison names at least one weakness of every scoring system discussed. It is written for change and risk managers, not as legal or compliance advice. Some outbound links may be affiliate links; they never change which tools we cover or how we assess them.

Why this matters right now

Yesterday’s KEV batch triage walkthrough ended on an uncomfortable point: when you sort the same three exploited CVEs by CVSS, you get a different order than when you sort by enforced deadline. That is not a quirk of one batch. It is baked into how the scores are built. A change advisory board that ranks its patch queue by CVSS alone will spend its emergency-change budget in the wrong order more often than not, because CVSS was never designed to rank what to fix first.

The stakes are practical. Every emergency change carries operational risk, review overhead, and a rollback plan someone has to write. If your CAB promotes a 10.0 to the front of the queue while a lower-scored bug is the one actually being weaponized against your sector, you have spent your risk budget defending the wrong asset. This piece compares the four systems a CAB is most likely to encounter (CVSS, EPSS, Tenable VPR, and CISA SSVC) on what each one measures, where each one lies to you, and how to sequence them without turning triage into a spreadsheet argument.

What does CVSS actually measure?

The Common Vulnerability Scoring System is an open framework maintained by the Forum of Incident Response and Security Teams (FIRST) that rates a vulnerability’s severity on a 0.0 to 10.0 scale, with v4.0 released on November 1, 2023 (FIRST CVSS user guide). The score maps to familiar bands: 9.0–10.0 Critical, 7.0–8.9 High, 4.0–6.9 Medium, 0.1–3.9 Low (FIRST CVSS v4.0 specification). Most organizations use only the Base score, which captures the intrinsic characteristics of the flaw.

Here is the part CABs routinely miss, stated plainly by the standard’s own maintainers: the CVSS Base score “measures severity, not risk,” and should not be used alone to assess risk (FIRST CVSS user guide). The Base group is constant over time and across environments. It does not know whether an exploit exists, whether attackers are using it today, or whether the affected system sits on your internet edge or in an air-gapped lab. That is by design. Severity is a property of the vulnerability; risk is a property of the vulnerability in your environment right now.

The consequence for a patch queue is well documented. Because CVSS bands cluster so many flaws at the top, it produces a queue that is too long to be useful. Tenable’s own analysis notes that CVSS rates roughly 60% of vulnerabilities High or Critical (Tenable VPR capabilities page). A CAB cannot run 60% of its backlog as priority work. CVSS is excellent at answering “how bad is this flaw in the abstract” and useless at answering “which of these forty Criticals do I schedule this week.”

How is EPSS different from CVSS?

The Exploit Prediction Scoring System, also from FIRST, answers a different question: it is a data-driven machine-learning model that estimates the probability a published CVE will be exploited in the wild within the next 30 days (FIRST EPSS overview). It publishes a score between 0 and 1 (read as 0% to 100%) plus a ranking percentile, for every published CVE, updated daily and available free with no registration (FIRST EPSS FAQ).

Under the hood, each daily EPSS record is built from roughly 2,850 features spanning signals that exist the day a vulnerability is disclosed through signals that only emerge weeks later, including how often security-relevant domains reference the CVE (“chatter”), the vulnerability’s own characteristics, and observed exploitation activity (FIRST EPSS methodology). That is a fundamentally different object from CVSS: it changes every day as the threat picture moves, where CVSS Base sits still.

EPSS is the closest thing a CAB has to a free, vendor-neutral “is this being used against people” signal. But it has a real weakness: probability is not impact. A bug can carry a 95% EPSS score and still be a low-consequence flaw on a system nobody cares about, and a genuinely dangerous flaw can sit at a low EPSS simply because attackers have not started at scale yet. FIRST is also explicit that the EPSS API is built for on-demand lookup of one CVE or a small batch, not for bulk-syncing every score into your own database (FIRST EPSS data guidance). Treat EPSS as a tiebreaker among things you already know matter, not as the whole decision.

What does Tenable VPR add?

Tenable’s Vulnerability Priority Rating is the commercial attempt to fold both halves, impact and exploitation likelihood, into one number. VPR is the output of Tenable’s Predictive Prioritization, expressed as a dynamic score from 0.1 to 10 that Tenable updates daily to reflect the current threat landscape, with the same Critical/High/Medium/Low bands as CVSS (Tenable Predictive Prioritization documentation). Mechanically, the enhanced VPR algorithm combines the CVSS impact subscore with a threat score derived from a Random Forest classification model that predicts near-term exploitation, a technique Tenable first patented in 2019 (Tenable VPR enhancements blog).

Tenable’s pitch is exactly the CVSS-backlog problem stated as a number: where CVSS flags ~60% of vulnerabilities as High or Critical, Tenable claims VPR pinpoints roughly 1.6% of exposures that pose real risk, a 98.4% reduction in the priority queue, scoring more than 280,000 distinct vulnerabilities nightly (Tenable VPR capabilities page). For a CAB, that is the appeal: a single ranked list short enough to actually work through.

VPR’s weaknesses are the flip side of its convenience. It is proprietary and locked to the Tenable platform, so a shop that does not run Tenable cannot reproduce it, and the ratings cannot be edited or customized (Tenable VPR documentation). Critically, VPR by itself does not know how important the affected asset is to you. That is a separate Asset Criticality Rating, and without it a high VPR on a throwaway dev box outranks a moderate VPR on your billing system. A single blended score is easier to sort, but it hides the asset-context decision that a CAB is supposed to own.

Where does CISA SSVC fit?

Stakeholder-Specific Vulnerability Categorization is the outlier, and the one most aligned with how a CAB actually thinks. Built by Carnegie Mellon University’s Software Engineering Institute with CISA in 2019–2020, SSVC is not a score at all. It is a decision tree that outputs an action: Track, Track*, Attend, or Act (CISA SSVC overview). The tree walks decision points a change manager already reasons about: exploitation status (None, Proof-of-Concept, or Active), technical impact, whether exploitation is automatable, and mission and exposure factors (CISA SSVC calculator).

The design goal is explicitly to avoid one-size-fits-all scoring in favor of a modular model that different stakeholders can tune to their own risk appetite, an approach SEI positions as a direct answer to the limitations of CVSS (SEI SSVC version 2.0 paper). SSVC’s weakness is the cost of that flexibility: it needs human judgment and per-vulnerability inputs, so it does not scale like an automated feed, and CISA’s published tree is tuned to government and critical-infrastructure stakeholders rather than a generic enterprise CAB, so you have to adapt it before it fits.

Why does the same batch rank differently?

Run the three CVEs CISA added on August 11, 2026 through each lens and the ordering breaks apart. All three are on the KEV catalog, which means exploitation is confirmed for every one of them (CISA KEV live table).

Bar chart comparing three August 11 2026 KEV CVEs (Metabase SQLi, Cisco ASA/FTD DoS, Windows AFD.sys EoP) across CVSS severity, EPSS 30-day probability, and normalized KEV deadline pressure, showing the priority order inverts depending on the lens

By CVSS, the Metabase SQL injection flaw (CVE-2026-72898) leads at 10.0, ahead of the Cisco ASA/FTD denial-of-service bug (CVE-2026-20349) at 8.6 and the Windows AFD.sys elevation-of-privilege flaw (CVE-2026-68820) at 7.0 (CISA KEV entries). By EPSS the picture is nearly flat: all three sit at low single-digit-percent probabilities, so EPSS barely separates them. By enforced deadline, the Metabase and Cisco bugs share an August 14 due date while the Windows bug runs to August 25, which promotes the two short-fuse items regardless of their CVSS gap. Three defensible lenses, three different queues. The lesson is not that one is right. It is that KEV membership is the real gate, and the scores only help you sequence what is already inside it.

What to do about it

  1. Gate on confirmed exploitation first. If a CVE is on CISA KEV or lands on SSVC “Act,” it jumps the queue no matter what its CVSS says, because exploitation-in-the-wild beats abstract severity every time (CISA KEV overview).
  2. Use CVSS to size, not to rank. Read the Base score as “how bad if exploited,” then stop; do not let it order your queue, because it wasn’t built for that (FIRST CVSS user guide).
  3. Rank the survivors by EPSS or VPR. Among the KEV/Act set, use EPSS (free) or VPR (if you run Tenable) to sequence, but treat both as likelihood signals, not asset-aware verdicts (FIRST EPSS overview).
  4. Add your own asset context last. Whatever score wins, weight it by exposure and business criticality before it hits the CAB agenda; a moderate score on an edge-facing billing system outranks a high score on an isolated lab box. Our change risk scoring tool helps quantify that adjustment.
  5. Write the sequencing into policy. Codify “KEV gate, then EPSS/VPR rank, then asset weighting” as a standing rule so triage is not re-argued every incident. Pair it with a fixed cadence using the Patch Tuesday planning calendar.

Frequently asked questions

Is a higher CVSS score always more urgent to patch? No. CVSS measures severity, not risk, and FIRST says it should not drive prioritization alone; an actively exploited lower-scored flaw outranks a higher-scored one with no exploitation (FIRST CVSS user guide).

What is the difference between EPSS and CVSS? CVSS rates static intrinsic severity 0–10; EPSS is a daily probability (0–100%) that a CVE will be exploited within 30 days. They answer different questions and belong together (FIRST EPSS FAQ).

Is Tenable VPR better than CVSS? VPR ranks a backlog better because it blends impact with a threat model, but it is proprietary, non-customizable, and asset-context-blind on its own (Tenable VPR documentation).

What is CISA SSVC and how does it differ from a score? SSVC is a decision tree that outputs an action (Track, Track*, Attend, or Act) rather than a number, and is meant to be tuned per stakeholder (CISA SSVC calculator).

Should EPSS or KEV drive an emergency change? KEV should, because confirmed exploitation plus a deadline beats any probability estimate; use EPSS only to sequence multiple KEV items (FIRST EPSS overview).

Why do the same CVEs rank differently under each system? Because each measures a different property (severity, likelihood, blended threat, or stakeholder impact), so one batch yields four orderings by design (SEI SSVC version 2.0 paper).

For the full menu of ITSM and risk tooling we compare, see the tools comparisons pillar.

Sources

#vulnerability-prioritization #cvss #epss #vpr #cab

Published August 13, 2026.