Risk-based prioritization
A scan can return dozens of CVEs, and severity alone does not say which one to fix first. For eligible CVE findings, ScanTitan shows the CVSS severity next to two exploitation signals: CISA KEV, which records known exploitation, and FIRST EPSS, which estimates the probability that a CVE will be exploited. Together they help you decide what needs attention first.
KEV and EPSS enrichment applies to eligible CVE findings when the intelligence is available. It is not a separate premium add-on.
Review scan plansTry the CVE Priority CheckerA score for the technical severity of a vulnerability. It describes the flaw, not whether anyone is attacking it.
The Known Exploited Vulnerabilities catalog lists CVEs with evidence of exploitation. It records what has already happened.
A model that estimates the probability that a published CVE will be exploited in the next 30 days.
Read the definitions from the sources: the CISA KEV catalog and the FIRST EPSS model. Each signal answers a different question, which is why a high CVSS score alone is a weak way to order a patching queue.
This table is a reading guide. It is not a scan result.
| What you see | How to read it |
|---|---|
| Listed in KEV | Known exploitation exists. Fix first on any asset where the affected software is present and exposed. |
| High EPSS, not in KEV | No known exploitation record yet, but exploitation is likely. Fix soon. |
| High CVSS, low EPSS, not in KEV | Severe flaw with little sign of attack. Schedule by exposure and asset importance. |
| Intelligence unavailable | Use CVSS and exposure. Do not read the absence of a signal as safety. |
The prioritization signals are not Business-only. Public server and IP assessments, where CVE matching is most common, are available with Business at $155 per asset place per year, and Consultant at $486 per asset place per year adds client reporting. See the pricing page for what each plan includes.
These findings appear in the network vulnerability scanner and IP vulnerability scanner results, and in the reports you export for clients through the Consultant plan.
It is ordering vulnerabilities by how urgently they need fixing, using more than severity alone. ScanTitan combines CVSS with CISA KEV and FIRST EPSS for eligible CVE findings.
KEV is the Known Exploited Vulnerabilities catalog. A CVE in it has evidence of real-world exploitation.
EPSS estimates the probability that a published CVE will be exploited in the next 30 days.
No. It describes how likely exploitation of the CVE is in general. It does not prove that your asset is targeted.
No. KEV lists known exploitation. A CVE missing from it may still be exploited or become exploited.
Eligible CVE findings, when the intelligence is available. Other findings do not carry these labels.
No. It is part of the findings. Business adds public server assessments and Consultant adds client reporting.
See which plan fits the assets you need to assess, or try the CVE Priority Checker on a list of CVEs.
Review scan plansTry the CVE Priority CheckerThese ScanTitan features work alongside this one.
