KEV and EPSS
CISA's Known Exploited Vulnerabilities catalogue and FIRST's EPSS score, and where RevoSecure uses them to prioritise.
Updated
CVSS says how bad a vulnerability could be. KEV and EPSS say whether it's being, or likely to be, exploited. RevoSecure uses both to decide what goes first.
KEV: known exploited
The Known Exploited Vulnerabilities (KEV) catalogue is published by the US Cybersecurity and Infrastructure Security Agency (CISA). A CVE is added only when there's reliable evidence of exploitation in the wild and a clear fix. It's a short list, a tiny fraction of all CVEs, which makes it a strong signal: if a customer has a KEV vulnerability, attackers are already using it somewhere.
RevoSecure marks these Actively exploited (or KEV) and uses them in several places:
| Where | Effect |
|---|---|
| Findings | A KEV flag and filter. KEV adds 10 to a finding's risk score |
| Vulnerabilities | Sorted first; Actively exploited only filter. Any KEV vulnerability on a package raises a finding |
| Home and Overview | KEV vulnerabilities appear in Needs attention / Act now |
| Patching | Pending updates that fix a KEV vulnerability are tagged Actively exploited and, by default, skip the policy's waiting days and ring delays (the KEV fast track) |
| Notifications | An actively exploited vulnerability on a customer's systems alerts the workspace's alert recipients, in the app and by email |
When CISA adds entries whose vendor and product match installed software names, each workspace gets a "possible exposure: verify" notification.
EPSS: likelihood of exploitation
The Exploit Prediction Scoring System (EPSS) is maintained by FIRST. It gives each CVE a probability, from 0% to 100%, that it will be exploited in the next 30 days, based on observed exploitation activity and the vulnerability's characteristics. It's updated daily.
Most CVEs have an EPSS below a few percent. A high EPSS on a vulnerability that isn't on KEV yet is an early warning.
| Where | Effect |
|---|---|
| Finding detail | EPSS (max): the highest EPSS of the finding's CVEs, and per-CVE values under Vulnerability intelligence (CVSS, EPSS, KEV) |
| Risk score | Adds up to 10 points: the probability × 20, capped at 10. A CVE with 50% or more gets the full 10 |
| Vulnerability detail | EPSS for each CVE |
How they combine
A finding's risk score starts from its severity and adds evidence: KEV, EPSS, asset criticality, confidence and whether it's internet-facing. Two high-severity findings can therefore sit far apart in the list: one on KEV with a high EPSS on an internet-facing server ranks near the top, while one with a low EPSS on an internal test machine ranks much lower. See Severity, risk and the security score.
Why not just CVSS
NIST cut back enrichment of the US National Vulnerability Database in 2026, so many new CVEs never get an NVD CVSS score or product data. RevoSecure's matching is therefore built on OSV (published by ecosystems and distributions), with KEV for what's being exploited and EPSS for what's likely to be. CVSS is still shown where it exists.