EPSS vs. CVSS: Exploit prediction could change the game on software risk management

Security teams are faced with more alerts than they can handle. SecurityScorecard and the Cyentia Institute estimate that organizations fix only 10% of the vulnerabilities in their software each month. That's not a good outcome for software security — nor for overworked application security and security operations teams.

The most-used tool for assessing software risk is the Common Vulnerability Scoring System (CVSS), which offers a score to assess the risk specific vulnerabilities pose to an organization. However, a number …

alerts application application security change cvss cyentia institute epss exploit fix game good management operations organizations prediction risk risk management security security operations securityscorecard security teams software software security teams vulnerabilities