When prioritizing remediation after a vulnerability scan, which approach is supported by combining CVSS scores with EPSS estimates?

• A. Consider CVSS scores and EPSS together to gauge near-term exploitability and risk
• B. Rely only on CVSS scores
• C. Rely only on EPSS
• D. Patch only vulnerabilities labeled critical

Answer: (A)

Combining CVSS scores with EPSS estimates gives the most practical basis for prioritizing remediation because it blends potential impact with real-world likelihood. CVSS scores reflect how severe a vulnerability could be if exploited—the potential damage, ease of exploitation, and impact on confidentiality, integrity, and availability. But CVSS doesn’t tell you how likely attackers are to exploit it in the near term. EPSS provides that probability, indicating how likely a vulnerability is to be exploited in the next 12 months. Using both together lets you rank fixes by risk: vulnerabilities with high impact and high likelihood of exploitation are top priorities, while those with high impact but low likelihood can be scheduled more flexibly, and those with low impact but high likelihood still warrant attention due to active exploitation potential. Relying only on CVSS ignores exploit probability, and relying only on EPSS ignores potential damage, so the combined approach gives a more accurate, action-oriented prioritization.