--- title: "Vulnerability prioritization: discovery isn't the problem anymore" description: 48,000 CVEs were published in 2025. Only 58 really mattered. CVSS and EPSS tell you only part of the picture image: https://blog.unguess.io/hubfs/Vulnerability%20Prioritization%20Stripe-selection.png --- [![Vai alla homepage di UNGUESS](https://blog.unguess.io/hubfs/Imported%20images/unguess-logo.svg)](https://unguess.io/it) - PRODUCTS BY INDUSTRY - [Retail & Ecommerce](https://unguess.io/services/industry/retail-ecommerce/) - [Fast-Moving Consumer Goods](https://unguess.io/services/industry/fast-moving-consumer-goods/) - [Banking, Insurance & Financial Services](https://unguess.io/services/industry/banking-insurance-financial-services/) - [Travel & Hospitality](https://unguess.io/services/industry/travel-hospitality/) - [Utilities](https://unguess.io/services/industry/utilities/) - [Healthcare](https://unguess.io/services/industry/healthcare/) - [Media & Entertainment](https://unguess.io/services/industry/media-entertainment/) - [Automotive](https://unguess.io/services/industry/automotive/) - PRODUCTS BY USE CASE - [Ai Training](https://unguess.io/services/ai-training-testing/) - [User Experience](https://unguess.io/services/use-case/user-experience/) - [Software Quality](https://unguess.io/services/use-case/software-quality/) - [Cyber Security](https://unguess.io/services/use-case/cyber-security/) - [Accessibility](https://unguess.io/services/accessibility/) - [HOW IT WORKS](https://unguess.io/how-it-works/) - [OUR CROWD](https://unguess.io/our-crowd/) - COMPANY - [About us](https://unguess.io/about-us) - [Life at UNGUESS](https://unguess.io/life-at-unguess/) - [Partners](https://unguess.io/unguess-partners/) - [SHOWCASES](https://unguess.io/showcases/) - [Case Study](https://unguess.io/showcases/all-showcases/?jsf=jet-engine:shocase-listing-grid&tax=resource-category:76/#readmore) - [Unguess Challenges](https://unguess.io/showcases/all-showcases/?jsf=jet-engine:shocase-listing-grid&tax=resource-category:74/#readmore) - [White Paper](https://unguess.io/showcases/all-showcases/?jsf=jet-engine:shocase-listing-grid&tax=resource-category:75/#readmore) - [BLOG](https://blog.unguess.io) - - - - - [PRODUCTS](https://unguess.io/services/) - BY INDUSTRY - [Retail & Ecommerce](https://unguess.io/services/industry/retail-ecommerce/) - [Fast-Moving Consumer Goods](https://unguess.io/services/industry/fast-moving-consumer-goods/) - [Banking, Insurance & Financial Services](https://unguess.io/services/industry/banking-insurance-financial-services/) - [Travel & Hospitality](https://unguess.io/services/industry/travel-hospitality/) - [Utilities](https://unguess.io/services/industry/utilities/) - [Healthcare](https://unguess.io/services/industry/healthcare/) - [Media & Entertainment](https://unguess.io/services/industry/media-entertainment/) - [Automotive](https://unguess.io/services/industry/automotive/) - BY USE CASE - [Ai Training](https://unguess.io/services/ai-training-testing/) - [User Experience](https://unguess.io/services/use-case/user-experience/) - [Software Quality](https://unguess.io/services/use-case/software-quality/) - [Cyber Security](https://unguess.io/services/use-case/cyber-security/) - [Accessibility](https://unguess.io/services/accessibility/) - [VIEW ALL PRODUCTS](https://unguess.io/services/) - [HOW IT WORKS](https://unguess.io/how-it-works/) - [OUR CROWD](https://unguess.io/our-crowd/) - COMPANY - [About us](https://unguess.io/about-us/) - [Life at UNGUESS](https://unguess.io/life-at-unguess/) - [Partners](https://unguess.io/partners/) - [SHOWCASES](https://unguess.io/showcases/) - [Case Study](https://unguess.io/showcases/case-study/) - [Unguess Challenges](https://unguess.io/showcases/unguess-challenges/) - [White Paper](https://unguess.io/showcases/white-paper/) - [Webinar](https://unguess.io/showcases/webinar/) - [BLOG](https://blog.unguess.io) - - - - [CONTACT US](https://unguess.io/it/inizia-ora/) [SIGN UP](https://app.unguess.io/) Cybersecurity # Vulnerability prioritization: discovery isn't the problem anymore 48,000 CVEs were published in 2025. Only 58 really mattered. CVSS and EPSS tell you only part of the picture [Luca Manara](https://blog.unguess.io/author/luca-manara) Sep 14, 2026 --- ## **Key takeaways** - Most organizations remediate only ~10% of open vulnerabilities per month, regardless of size or maturity (Cyentia). - Of 48,000+ CVEs published in 2025, ~800 were exploited in the wild. Only ~58 were reachable and likely to be targeted (Black Kite). - Full AI automation is losing ground: 29% to 9% in a year, with 78% reporting missed critical bugs (Cobalt). - The only reliable signal is an exploitation attempt from outside, validated by a human.   A CISO told me recently that she doesn't need help finding [vulnerabilities](https://security.unguess.io/app). She already has thousands. What she needs to know is which twelve matter this quarter. That is what vulnerability prioritization has become. Not a reporting feature buried inside a scanner, but the single decision that determines whether a security budget produces actual risk reduction or just a longer backlog. And the data behind that decision is unforgiving.   ## What vulnerability prioritization actually is   **Vulnerability prioritization** is the process of deciding which of the known vulnerabilities in your environment get fixed first, based on how likely each one is to be exploited against you specifically, rather than on theoretical severity alone. In practice it is a filtering problem: taking tens of thousands of published CVEs and reducing them to the short list an attacker could realistically use against your exposed assets. The short version of what follows: severity scores describe a vulnerability, exploitability evidence describes your exposure, and only the second one can rank a backlog.   ## The remediation ceiling nobody can hire their way past Research from the Cyentia Institute, analyzing 3.6 billion vulnerability observations, found that the typical organization can remediate only about 10% of its open vulnerabilities per month. That number barely moves whether you are a five person startup or a global bank with a mature program.  Meanwhile the volume keeps climbing. The first half of 2026 alone produced 35,364 new CVEs, one every 7.4 minutes, up roughly 50% year over year. Tenable research puts the average enterprise backlog at over 100,000 open vulnerabilities in two thirds of organizations. Edgescan's 2025 statistics found that 45% of discovered vulnerabilities are still unpatched after twelve months. Detection has vastly outpaced the capacity to act on what gets detected. Some in the industry call this the "find but never fix" crisis. It is an accurate name.   ## 48,000 published CVEs, 58 that actually mattered Here is the number that reframes the whole problem. Of the 48,000+ CVEs published in 2025, Black Kite's research estimates roughly 800 were ever exploited in the wild. Filter further, for vulnerabilities that are both discoverable from outside your perimeter and carry a genuinely high probability of targeted exploitation, and you are down to 58. Forty eight thousand published. Fifty eight that actually mattered. So the problem was never volume. The problem is that almost nothing in the standard toolkit can reliably tell you which handful of the 48,000 are the ones aimed at you.   ## CVSS and EPSS can help, but it's just the first step CVSS (Common Vulnerability Scoring System) measures severity, how bad the impact would be if the vulnerability were exploited. It's a 0–10 score built from characteristics like attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. It's maintained by FIRST, and the current version is 4.0 (3.1 is still widely used). CVSS says nothing about whether anyone is actually attacking it. EPSS (Exploit Prediction Scoring System) measures likelihood, the probability that a given CVE will be exploited in the wild in the next 30 days. Also from FIRST, it's a data-driven model that outputs a probability from 0 to 1, updated daily, based on signals like exploit code availability, vendor, CVE age, and observed exploitation activity. CVSS measures theoretical severity but It has no idea whether your specific controls would block the exploit path, and FIRST itself states that base scores should not be used alone for prioritization. EPSS, the Exploit Prediction Scoring System, estimates real world exploitation probability across the internet. But it still has never seen your environment, and it arrives later than most teams assume. Nucleus Security studied CVEs added to CISA's Known Exploited Vulnerabilities catalog and found that the median EPSS score movement was 121 times larger after a vulnerability was confirmed exploited than before. In several cases, active exploitation was already underway before EPSS gave any meaningful signal.   | Signal | What question it answers | What it cannot tell you | | --- | --- | --- | | CVSS | How severe is this vulnerability in theory? | Whether it is reachable or blocked in your stack | | EPSS | How likely is exploitation somewhere on the internet? | Whether you are the target, and it often moves after the fact | | CISA KEV | Has this been exploited against someone, confirmed? | Whether you are exposed to it right now |   Global scoring systems answer a global question: how dangerous is this vulnerability, in general, across the internet? They were never built to answer the only question that matters to you, which is whether this one is exploitable, specifically, in your environment, right now. There is only one reliable way to answer that. Try it, from the outside, using the same tools and the same perspective an actual attacker would use.   ## Why the answer still needs a human in it This is where the industry's own recent data gets interesting. Cobalt's 2026 AI and Pentesting Pulse Report, surveying 455 security professionals, found that the share of organizations relying entirely on AI automation for testing dropped from 29% to 9% in a single year. The reason: 78% had experienced fully automated scanning tools missing critical vulnerabilities outright (false negatives). A Stanford study (ARTEMIS) measuring autonomous AI pentest agents against human testers found the best performing agent still submitted 18% invalid findings. Top human testers hit 100% valid. Off the shelf agent tooling, not purpose built for the task, was far worse: the best of those reached only a 55% valid submission rate. None of this means AI does not belong in the process. It means AI is excellent at generating candidates and not so good, on its own, at being the final word on whether a candidate is real. Someone has to close that gap, and right now that someone is a human who stakes their professional judgment on being right.   ## How to prioritize vulnerabilities: four rules for buying security testing Put the pieces together and a different way of buying security testing falls out naturally. - **Test from the outside, the way an attacker actually would.** Not just what internal scanners can see, but what is visible and reachable to someone with no inside knowledge of your architecture. - **Validate every finding with a expert before it reaches your team**, so your backlog becomes a list of confirmed, exploitable issues instead of a longer list of maybes. - **Pay for the confirmed findings, not the process.** If discovery volume is not the bottleneck, there is no reason to keep paying for volume. Pay when something real is found, nothing when it is not. - **Keep the record of everything that was tried and did not work, not just what succeeded.** This turns out to matter almost as much as the findings themselves. When a regulator or an auditor asks how you know your prioritization decisions were sound, "here is everything an external attacker's toolset attempted against our perimeter, and here is what held" is a fundamentally stronger answer than a scanner report. Under frameworks like NIS2 and DORA, that distinction is the difference between a defensible process and an assertion. ## How UNGUESS Security applies this UNGUESS Security is the offensive security arm of UNGUESS, with a network of 200+ European security researchers working alongside specialized AI agents. The model maps directly onto the four rules above. The platform maps your exposure the way a hacker sees it, same outside in perspective, no assumptions about internal architecture you have not confirmed. Every candidate finding is then attempted and validated by a vetted ethical hacker before it becomes something your team has to act on. You pay for the vulnerabilities that turn out to be real, and nothing for the ones that do not, because the commercial model is success fee by design. You also get a full account of what was tried against everything else, which is exactly the evidence an auditor or regulator wants to see when they ask how you knew your priorities were right. If you want to see the starting point of that picture for your own domain, the self serve vulnerability scan on [`security.unguess.io/app`](https://security.unguess.io/app)maps your externally exposed assets and returns a report within a few hours.   ## The backlog is not going to get shorter CVE volume is not slowing down, and no organization is going to remediate its way to zero open vulnerabilities. That was never really the game. The game is knowing, with confidence, which small number out of the large number is the one an attacker would actually use, and being able to prove, later, that you knew. *See what a hacker sees: [security.unguess.io/app](http://security.unguess.io/app)*   ## Frequently Asked Questions ### What is vulnerability prioritization? Vulnerability prioritization is the practice of ranking known vulnerabilities by the likelihood they will be exploited against a specific organization, so that limited remediation capacity goes to the issues that carry real risk. It exists because most organizations can only remediate around 10% of their open vulnerabilities per month, according to Cyentia Institute research across 3.6 billion vulnerability observations.  ### How do security teams decide which vulnerabilities to fix first? Mature teams combine three inputs: severity scoring such as CVSS, exploitation probability such as EPSS or the CISA Known Exploited Vulnerabilities catalog, and evidence of actual exploitability in their own environment. The third input is the decisive one, because the first two describe the internet at large and not a specific perimeter. Evidence of exploitability comes from attempting the exploit from outside the organization, the way an attacker would.  ### What is the difference between CVSS and EPSS? CVSS scores the theoretical severity of a vulnerability, on a scale from 0 to 10, independently of who is affected. EPSS estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. CVSS answers "how bad could this be", EPSS answers "how likely is anyone to use it". Neither one knows whether the vulnerability is reachable in your stack, which is why FIRST advises against using CVSS base scores alone for prioritization. ### Can AI handle vulnerability prioritization on its own? Not yet, and the trend is moving the other way. Cobalt's 2026 survey of 455 security professionals found that the share of organizations relying entirely on AI automation for testing fell from 29% to 9% in one year, with 78% reporting that fully automated tools had missed critical vulnerabilities. A Stanford study of autonomous pentest agents found the best agent still submitted 18% invalid findings, against 100% valid for top human testers. AI is highly effective at generating candidate findings and unreliable as the final arbiter of whether a finding is real.  ### How do you prioritize vulnerabilities at scale in a regulated industry? At scale, prioritization has to produce evidence, not just a ranked list. That means recording both the vulnerabilities that were confirmed exploitable and everything that was attempted and failed, so the decision to deprioritize an item is documented rather than implied. Regulated organizations under NIS2, DORA or PSD2 are increasingly asked to show the reasoning behind remediation sequencing, and a scanner export does not contain that reasoning.  ### How many published CVEs actually get exploited? Very few. Of the 48,000+ CVEs published in 2025, Black Kite estimates roughly 800 were ever exploited in the wild. Narrowing to vulnerabilities that are both externally discoverable and carry a high probability of targeted exploitation brings that number down to around 58. [Cybersecurity](https://blog.unguess.io/tag/cybersecurity) [Share via Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fblog.unguess.io%2Fvulnerability-prioritization) [Share via Twitter](https://twitter.com/intent/tweet?url=https%3A%2F%2Fblog.unguess.io%2Fvulnerability-prioritization&text=Vulnerability+prioritization%3A+discovery+isn%27t+the+problem+anymore) [Share via Email](mailto:?subject=Vulnerability+prioritization%3A+discovery+isn%27t+the+problem+anymore&body=https%3A%2F%2Fblog.unguess.io%2Fvulnerability-prioritization) [Share via LinkedIn](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fblog.unguess.io%2Fvulnerability-prioritization&title=Vulnerability+prioritization%3A+discovery+isn%27t+the+problem+anymore&summary=48%2C000+CVEs+were+published+in+2025.+Only+58+really+mattered.+CVSS+and+EPSS+tell+you+only+part+of+the+picture) ## Similar posts Cybersecurity ### [How to read the Cyber Resilience Act request of "effective and regular tests](https://blog.unguess.io/cyber-resilience-act-testing-requirements?hsLang=en) Cyber Resilience Act requirements: what testing must prove. The CRA asks for effective and regular security tests but sets no method or frequency.... Luca Manara Sep 22, 2026 Cybersecurity ### [AI Bug Bounty: why human hackers still find what AI misses](https://blog.unguess.io/ai-bug-bounty-human-researchers?hsLang=en) We asked the UNGUESS Security community how they use AI: 90% use it daily, almost none for vulnerability hypotheses. What that means for bug bounty. Luca Manara Aug 25, 2026 Cybersecurity ### [Understanding Zero-Day threats in Cybersecurity](https://blog.unguess.io/understanding-zero-day-threats-in-cybersecurity?hsLang=en) In this article, we aim to shed light on how Zero-Day vulnerabilities are identified and exploited by malicious actors Newsroom Apr 4, 2024 Cybersecurity ### [LockBit3.0, the evolution of the most powerful Ransomware-as-a-Service](https://blog.unguess.io/lockbit-3.0-most-powerful-ransomware-as-a-service?hsLang=en) How is LockBit born? How does it work? What advantages does it bring to cybercriminals? Discover an effective solution to protect yourself in only 24... Newsroom Jun 6, 2023 ![unguess-logo-1](https://blog.unguess.io/hubfs/unguess-logo-1.svg) **© 2023 UNGUESS S.r.l.** UNGUESS is a registered trademark of UNGUESS S.r.l.   - [![U2Y - Verified Carbon Footprint](https://blog.unguess.io/hs-fs/hubfs/U2Y%20-%20Verified%20Carbon%20Footprint.png?width=50&height=50&name=U2Y%20-%20Verified%20Carbon%20Footprint.png)](https://app.u2y.io/brands/314) - [![UNGUESS is a leader in Crowd Testing Tools on G2](https://images.g2crowd.com/uploads/report_medal/image/1004327/medal.svg)](https://www.g2.com/products/unguess/reviews?utm_source=rewards-badge) - [![UNGUESS is a leader in Test Management on G2](https://images.g2crowd.com/uploads/report_medal/image/1004327/medal.svg)](https://www.g2.com/products/unguess/reviews?utm_source=rewards-badge) - [![UNGUESS is a leader in Crowd Testing Tools on G2](https://images.g2crowd.com/uploads/report_medal/image/1004379/medal.svg)](https://www.g2.com/products/unguess/reviews?utm_source=rewards-badge) - [![UNGUESS is a leader in Europe Test Management on G2](https://images.g2crowd.com/uploads/report_medal/image/1004391/medal.svg)](https://www.g2.com/products/unguess/reviews?utm_source=rewards-badge) - [![UNGUESS is a leader in EMEA Test Management on G2](https://images.g2crowd.com/uploads/report_medal/image/1004447/medal.svg)](https://www.g2.com/products/unguess/reviews?utm_source=rewards-badge) #### SERVICES - [AI Training](https://unguess.io/services/ai-training-testing/) - [User Experience](https://unguess.io/services/use-case/user-experience/) - [Software Quality](https://unguess.io/services/use-case/software-quality/) - [Cyber Security](https://unguess.io/services/use-case/cyber-security/) - [Accessibility](https://unguess.io/services/accessibility/) #### SHOWCASE - [Blog](https://blog.unguess.io) - [Our Crowd](https://unguess.io/our-crowd/) - [Tryber.me](https://tryber.me/) - [Integrations](https://unguess.io/integrations/) - [Partners](https://unguess.io/partners/) #### COMPANY [Work with us](https://unguess.io/life-at-unguess/#job-positions) [Get in touch](https://unguess.io/get-started/) **General inquires:** [info@unguess.io](mailto:info@unguess.io)   [Privacy Policy](https://unguess.io/privacy-policy/)  | [ESG Policy](https://unguess.io/esg-policy/)  | [Personal Data Processing Notice: Customers and Suppliers](https://unguess.io/personal-data-processing-notice-customers-and-suppliers/) | [Model 231](https://unguess.io/model-231/) | [Ethical Code](https://unguess.io/ethical-code/) | [Cookies Settings](https://www.iubenda.com/privacy-policy/833252/full-legal)  |  [Terms & Conditions](https://unguess.io/terms-and-conditions/) UNGUESS S.r.l. – VAT 01603290196   © 2022 Kalungi, Inc. - All Rights Reserved. [Powered by Atlas - a B2B SaaS HubSpot theme](https://www.kalungi.com/atlas-hubspot-theme-for-b2b-saas-software)