Lion Cipher Lab

Build a risk-based vulnerability-management program (tiered remediation SLAs)

• GRC / Compliance
• Advanced
• ~60 min
• Free · no account required

Why it matters

A real vulnerability scanner returns thousands of findings, most of them tagged 'High.' A team that works them by raw severity -- top of the CVSS list down -- burns out patching 7.5s that will never be exploited while a quietly critical bug on the payments database ages past 30 days. That is the trap this lab exists to break. CVSS (the Common Vulnerability Scoring System, a 0-10 measure of a flaw's technical severity) tells you how bad a bug is in the abstract; it says nothing about whether anyone is actually exploiting it, or whether the box it sits on matters. EPSS (the Exploit Prediction…

What you'll learn

• designing a risk-based vulnerability-management PROGRAM instead of triaging one CVE at a time: an asset inventory, a scoring engine, remediation SLAs, compliance measurement, and an exception register
• building a small asset inventory with business-criticality tiers (crown-jewel / important / commodity) and understanding why the same CVE is a different risk on a different box
• writing a Python engine that fuses four signals per finding -- CVSS base severity (technical severity), EPSS (FIRST.org's probability the CVE is exploited in the next 30 days), CISA KEV membership (known-exploited-in-the-wild, a hard override), and asset criticality -- into a priority bucket
• mapping priority buckets to tiered remediation SLAs (e.g. KEV-or-EPSS>=0.5 on a business-critical asset -> 72 hours; high CVSS on an important asset -> 14 days; low-risk commodity -> 90 days) and computing which findings BREACH their SLA from a days-open field
• producing an SLA-compliance report and a risk-acceptance / exception register with a named owner and an expiry date for every accepted risk
• explaining why CVSS-base-score-alone prioritisation drowns a team -- CVSS measures technical severity, not likelihood or business context, so you get thousands of undifferentiated 7.5s most of which are never exploited
• explaining why EPSS adds the missing LIKELIHOOD dimension and why KEV is a 'drop everything' override -- already-exploited beats any probability
• naming the program failure modes: an SLA with no remediation capacity is theatre; an exception register with no expiry or owner is a graveyard; EPSS and KEV drift daily, so you must RE-SCORE on a cadence, never score-once
• situating this program layer above the single-vuln labs (KEV+EPSS prioritisation and SSVC) it is built on

Steps in this lab

1. Why sorting by severity alone drowns a team
2. The four signals you will fuse -- CVSS, EPSS, KEV, and criticality
3. How the priority buckets and SLAs work -- the decision logic
4. Set up: confirm Python and make a folder
5. Build the engine: inventory, scan, scoring, SLAs, compliance, exceptions
6. Run it and read the three reports
7. The failure modes -- and where this sits above the single-vuln labs
8. What you built -- and the reflex to keep

Open the full interactive lab →