3D Risk-Based Patch Prioritization: CVSS vs Exploit-in-the-Wild

Vulnerability backlogs are usually read as a flat, sorted list — but they're really points in a risk space with more than one axis. This 3D version makes that space explicit: every one of the same 20 vulnerabilities from the 2D original sits at a real coordinate, X for its raw CVSS severity, Y for its EPSS-style real-world exploitation-likelihood signal, split into two identical clusters — Org A on the left patching strictly by CVSS height, Org B on the right patching by exploitation-likelihood height first. Drag to orbit and the difference becomes spatial: Org A's tallest spheres (high exploit-likelihood, moderate CVSS) often sit untouched while it clears distant, rarely-exploited critical-CVSS spheres first. When an unpatched sphere is confirmed under active attack it gains a gold ring, and every exposed cycle rolls a chance of a breach — caught, its beacon flashes red in place, letting you watch the two strategies' outcomes diverge in real time rather than read them off two static lists.