Lion Cipher Lab
Prioritize a vulnerability list with CISA KEV and EPSS (why CVSS alone gets you patching the wrong things)
- Threat Intel Analyst
- Intermediate
- ~50 min
- Free · no account required
Why it matters
The single most common way a security team loses credibility is by handing operations a list of 400 "critical" vulnerabilities and demanding they all be patched this month. Ops can't do it, so they do none of it, and the two genuinely dangerous ones on that list sit unpatched for a year. Vulnerability management is not a scanning problem — scanners are cheap and everybody has one. It is a PRIORITIZATION problem, and prioritization is the part that is actually judgment. This lab teaches you the three data sources that modern teams combine to solve it, and, more importantly, how to defend the…
What you'll learn
- vulnerability prioritization
- reading CVSS, EPSS and KEV together
- querying the EPSS API
- working with the CISA KEV catalog
- risk-based triage decisions
- defending a deprioritization to a manager or auditor
Steps in this lab
- Feel the problem first: 400 rows and a team that can patch twelve
- What CVSS is genuinely good at — and the two things it never claimed to do
- CISA KEV: the free list of vulnerabilities that are definitely being used
- Download the KEV catalog and look inside it
- EPSS: a daily probability that someone will exploit it in the next 30 days
- The reading skill everyone gets wrong: score is not percentile
- Build the triage table
- The decision rule — and why asset context outranks every score
- The honest caveats, and how to say this to a manager, an auditor, or an interviewer