Vulnerability Management Chaining: An Integrated Framework for Efficient Cybersecurity Risk Prioritization

TL;DR

This paper introduces Vulnerability Management Chaining, a framework that combines KEV, EPSS, and CVSS to improve vulnerability prioritization efficiency and coverage, significantly reducing remediation workload using open-source data.

Contribution

The paper presents a novel decision tree framework that systematically integrates KEV, EPSS, and CVSS for more effective vulnerability prioritization.

Findings

18-fold efficiency improvement in vulnerability management

85.6% coverage of exploited vulnerabilities

95% reduction in urgent remediation workload

Abstract

As the number of Common Vulnerabilities and Exposures (CVE) continues to grow exponentially, security teams face increasingly difficult decisions about prioritization. Current approaches using Common Vulnerability Scoring System (CVSS) scores produce overwhelming volumes of high-priority vulnerabilities, while Exploit Prediction Scoring System (EPSS) and Known Exploited Vulnerabilities (KEV) catalog offer valuable but incomplete perspectives on actual exploitation risk. We present Vulnerability Management Chaining, a decision tree framework that systematically integrates these three approaches to achieve efficient vulnerability prioritization. Our framework employs a two-stage evaluation process: first applying threat-based filtering using KEV membership or EPSS threshold $\geq$ 0.088), then applying vulnerability severity assessment using CVSS scores $\geq$ 7.0) to enable informed deprioritization. Experimental validation using 28,377 real-world vulnerabilities and vendor-reported exploitation data demonstrates 18-fold efficiency improvements while maintaining 85.6\% coverage. Organizations can reduce urgent remediation workload by approximately 95\%. The integration identifies 48 additional exploited vulnerabilities that neither KEV nor EPSS captures individually. Our framework uses exclusively open-source data, enabling immediate adoption regardless of organizational resources.