Risk-Based Patch Prioritization: CVSS vs Exploit-in-the-Wild

Patch Cycle Engine

Patching capacity / cycle

Capacity 3 vulns

Cycle speed 1.0×

Severity (CVSS)

Critical 9.0–10.0 High 7.0–8.9 Medium 4.0–6.9 Low 0.1–3.9

Status

Patched Breached this run EXPLOITED = confirmed active in the wild

How this works

Both organizations face the same 20-item backlog and the same patching capacity per cycle — only their prioritization rule differs.

CVSS-only patches strictly by raw severity score, highest first, every cycle.
Risk-based patches by a real-world exploitation-likelihood signal first (an EPSS-style score, visible to it from cycle 1), falling back to CVSS only as a tiebreaker.
A vulnerability marked "EXPLOITED" is under confirmed active attack in the wild. If it's left unpatched while active, each cycle carries a chance of a breach.
Some high-CVSS bugs here are never actually exploited; some moderate-CVSS bugs become widely exploited. Watch which strategy reacts faster.

Cycle 0 / patching capacity 3 per organization per cycle

CVSS-only prioritization

Naive

Patched0

Breaches0

Risk-based prioritization

Risk-based

Patched0

Breaches0