CVSS vs KEV: Which Vulnerability Score Should You Trust?

What's on the Table

What if the number driving your patch queue is the least useful number you own?

That is the uncomfortable question behind a vendor launch that surfaced through Google News on July 29, 2026, covering Help Net Security's write-up of Root Evidence — a security company building vulnerability prioritization around evidence of actual exploitation rather than theoretical severity ratings. According to Help Net Security, the pitch is that security teams should rank flaws by observed real-world attack patterns, not by a severity score calculated in the abstract, and that doing so cuts the alert fatigue that leaves triage queues permanently underwater.

Strip the marketing away and the underlying claim is not new, which is exactly why it deserves scrutiny rather than applause. CISA's Known Exploited Vulnerabilities catalog has been publishing evidence-based prioritization since its launch in 2021, and EPSS — the Exploit Prediction Scoring System, a probabilistic model that estimates the likelihood a flaw gets exploited — has been steadily absorbed into enterprise workflows as a CVSS complement. The interesting question is not whether evidence beats theory. It is what a commercial evidence platform adds on top of two free, well-established public sources, and whether the arithmetic actually works out in the defender's favor.

One caveat on sourcing, and it matters: as of July 29, 2026, the coverage traces to a single outlet. Help Net Security is the only publication in the research trail reporting on Root Evidence's approach, with Google News acting as the aggregator. There is no second newsroom independently verifying the methodology, no published customer benchmark, and no third-party audit of detection coverage. That is a launch announcement, not a proven result, and it should be read as one.

The Arithmetic Nobody Runs

Here is the calculation that vendor decks tend to skip.

Organizations face over 25,000 CVEs disclosed annually as of 2024. Prioritization tooling, when properly implemented, is credited with reducing remediation workload by 70-90%. Take those two figures together and do the division: 25,000 disclosures a year is roughly 68 new vulnerabilities every single day. Cut 70% of that and you are still looking at 7,500 items a year, or about 21 per day. Cut a best-case 90% and you land at 2,500 a year — roughly 7 per day, every day, forever.

Seven per day is a workable number for a staffed team. Twenty-one is not, for most small and mid-sized IT departments running security as a part-time function. That gap between the low end and the high end of the advertised range is the entire difference between a program that stays current and one that quietly accumulates a backlog it will never clear. Any evaluation that treats "70-90%" as a single promise rather than a range with radically different operational outcomes is not being run seriously.

Chart: Baseline of over 25,000 CVEs disclosed annually as of 2024, with the 70% and 90% workload-reduction endpoints applied. Derived from the reported figures; individual environments will differ.

CVSS vs. KEV vs. EPSS: Who Wins Under Which Condition

The three scoring approaches are not competitors so much as answers to three different questions, and most teams get into trouble by asking the wrong one.

CVSS answers "how bad would this be if exploited?" It is a severity model, calculated from the technical characteristics of the flaw. It wins when you need a consistent, vendor-neutral way to describe impact — regulatory reporting, contract language, and internal severity policy all lean on it for good reason. It loses badly as a work-ordering mechanism, because a critical-rated flaw in software no attacker has ever bothered to weaponize still shows up screaming red next to a medium-rated bug under active mass exploitation.

CISA's KEV catalog answers "is this being exploited right now, confirmed?" It wins on precision. Everything on it is real, documented, and free. Its weakness is recall — a vulnerability being exploited quietly against a narrow target set may not appear until well after your window to patch cleanly has closed. KEV is a floor, not a ceiling.

EPSS answers "how likely is this to be exploited in the next 30 days?" It wins for forward-looking triage, catching probable threats before confirmation arrives. It is probabilistic, which means it is sometimes wrong, and a team that treats a low EPSS score as permission to ignore an internet-facing flaw has misread the tool.

So where does a commercial platform like Root Evidence fit? The honest answer is that its value proposition lives in the correlation layer — matching exploitation evidence against your specific asset inventory, exposure, and compensating controls, so that a mass-exploited flaw in software you do not run stops consuming attention. That contextualization is genuinely hard to do with public feeds alone, and it is the same architectural problem the industry keeps rediscovering: raw threat intelligence is cheap, and the mapping to your environment is where the cost sits. Buyers evaluating this category should ask the vendor to demonstrate the correlation against a sample of their own asset data before signing, the same verification discipline that AI Agents Weekly applied to enterprise AI gateway claims.

The AI layer deserves one sentence, not a section: machine learning is what makes correlation across exploit code repositories, dark-web chatter, and commercial threat intelligence feeds tractable at scale, and it is also the part of the stack most prone to being oversold, since a model trained on public exploitation signals inherits every blind spot those signals already have.

Harden This Today

Skip the procurement cycle for a moment. There is one control that delivers most of the benefit at zero cost, and most organizations have not shipped it.

Wire the CISA KEV catalog directly into your patch workflow as an automatic severity override. Any CVE that appears in KEV and matches an asset in your inventory gets promoted to your top remediation tier immediately, regardless of its CVSS rating. It is a machine-readable feed, it is free, and it is the single highest-signal input available to a defender. Teams that do this discover their genuine emergency queue is a fraction of what their scanner was insisting on — which is the same outcome the commercial tools are selling, achieved with a scheduled job and an asset list.

Do that first. Then, if the residual volume is still unmanageable, you have a defensible business case for buying correlation — and a baseline to measure any vendor against, which is a far stronger negotiating position than walking in with an undifferentiated backlog.

Disclaimer: This article is editorial commentary based on publicly reported information and does not constitute professional security consulting advice, nor does it reflect independent product testing. Always consult a qualified cybersecurity professional for your specific environment. Research based on publicly available sources current as of July 29, 2026.