Beyond Severity: Rethinking Vulnerability Prioritization

In this blog, we reflect on vulnerability data from 2024 to argue that effective vulnerability prioritization cannot rely solely on severity ratings - organizations patching critical vulnerabilities immediately, while scheduling others for the next patch cycle. We contend that an effective prioritization strategy must incorporate additional factors, such as threat intelligence on exploitation status, the availability of proof-of-concept (PoC) exploits, and more.

Why Effective Prioritization Requires More Than Severity Ratings?

In 2024, 32,958 vulnerabilities were published, with 3,082 of them rated as critical — an average of approximately 9 critical vulnerabilities per day. An organization relying solely on severity ratings to immediately patch its systems would be rebooting its systems continuously, making it impossible to focus on business goals. Moreover, while the volume of critical vulnerabilities is high and trending upward, these account for only 37.4% of exploited vulnerabilities, according to the EPSS Study. Additionally, as shown in our previous comparison between the U.S. and Chinese national vulnerability databases, severity ratings for the same vulnerability could differ significantly. This discrepancy highlights the limitations of relying solely on severity ratings for patch prioritization. So how can resource allocation be optimized to effectively minimize risks associated with vulnerabilities? To address this, we must first analyze the challenges through a data-driven lens.

CISA’s KEV: Top 50 Exploited Vulnerabilities of 2024 Analyzed by Exploitation Speed

The table below highlights the top 50 vulnerabilities from 2024 listed on CISA’s Known Exploited Vulnerabilities (KEV) catalog. These are vulnerabilities for which CISA has evidence of active exploitation. The last column of the table shows how many days elapsed between the publication of the CVE and CISA adding the vulnerability to its KEV list. As the data reveals, evidence of exploitation for these top 50 vulnerabilities was available within one day at most, necessitating immediate patching or mitigation. However, as shown in the table, the majority of these vulnerabilities are not rated as critical. Instead, many are rated as high, and a significant number are even rated as medium. This underscores the limitations of relying solely on severity ratings for prioritization, as exploitation often does not align with traditional severity classifications.

PoCs in GitHub: Top 50 Vulnerabilities of 2024 Analyzed by Number of PoCs

A Proof of Concept (PoC) provides ready-made code that simplifies the exploitation of a vulnerability. By demonstrating how the vulnerability can be exploited, a PoC removes much of the guesswork and technical barriers for attackers. Once a PoC is publicly available, it significantly reduces the time, effort, and expertise required to weaponize the vulnerability. This lowers the threshold for exploitation, making it accessible even to less sophisticated threat actors. The following table highlights the top 50 vulnerabilities from 2024 based on the number of published PoCs available on GitHub. In other words, those that garnered the most attention from ’ethical’ hackers. This table shows a stronger correlation with severity ratings. However, it also shows that vulnerabilities rated as high were nearly as compelling as those rated critical. Additionally, it is worth noting that fewer than half of the vulnerabilities in this table overlap with those in the first table. This emphasizes the importance of a model that accounts for multiple factors.

How To Effectively Prioritize?

We recommend adopting more nuanced, context-sensitive approaches like the Stakeholder-Specific Vulnerability Categorization (SSVC) introduced by CISA. SSVC proposes a decision tree model that allows for customized prioritization based on threat landscape and organization’s specific needs.

To help organizations allocate resources effectively and address the most risky vulnerabilities, we have been publishing weekly blog posts since Week 32 of 2024 (end of July), highlighting the top 5 vulnerabilities each week. This prioritization is based on such a decision-tree model trained on over 150,000 vulnerabilities. During this period, approximately 14,915 vulnerabilities were published, of which 119 were shortlisted. Below are some statistics about them:

• Severity Distribution:

• Included in CISA KEV: 28 - When comparing the timelines, on average, the series was 9 days ahead of CISA KEV in identifying risky vulnerabilities. That is, our prioritization process shortlisted those vulnerabilities earlier before industry bodies formally recognize them.

• Availability of PoCs:

  • Shortlisted vulnerabilities with PoC-in-GitHub repositories: 63
  • Shortlisted vulnerabilities with Nuclei Templates: 35
  • Shortlisted vulnerabilities with Nessus Plugins: 41
  • Number of active Nessus Plugins: 8

In a nutshell, adopting a flexible and risk-aware approach to vulnerability patch prioritization is the way forward. Thank you for following our Top 5 series. Stay tuned for more insights in the coming year!