Longitudinal, ground-truth, and outcome-based validation of impact-weighted vulnerability prioritization (composite KRI vs. EPSS and CVSS)

Organizations triage tens of thousands of disclosed software vulnerabilities each year, mostly by CVSS severity, even though severity predicts real exploitation barely better than chance. Sherif et al. (2026) proposed a composite Key Risk Indicator (KRI) that multiplies the Exploit Prediction Scoring System (EPSS) exploit-probability score, a CVSS-derived impact weight, and a CWE-prevalence exposure weight, and showed on 280,694 CVEs that it captures 92.3% of the oracle impact-weighted remediation value among the top-500 ranked vulnerabilities versus 82.6% for EPSS alone. That evidence is cross-sectional and rests on an incomplete exploitation ground truth, and the aggregation form was assumed rather than learned. The open problem is to establish, beyond a retrospective snapshot, whether impact-weighted composite prioritization genuinely outperforms exploit-probability or severity-only metrics: whether the advantage is temporally stable across each CVE's lifecycle, whether it survives correction of exploitation-label incompleteness in the KEV catalog, which aggregation form real remediation outcomes support, and whether asset-calibrated, KRI-guided teams capture more impact-weighted value per unit remediation effort in prospective deployment.

Background

A Common Vulnerability and Exposure (CVE) record is a public identifier for one disclosed software or hardware vulnerability; roughly tens of thousands are published per year, far more than any organization can patch promptly. The Common Vulnerability Scoring System (CVSS) assigns each CVE a technical severity score (Low/Medium/High/Critical) based on exploitability and impact metrics; it deliberately ignores real-world adversary behavior. The Exploit Prediction Scoring System (EPSS), introduced by Jacobs et al. (2021), is a daily-updated machine-learned probability (0 to 1) that a CVE will be exploited in the wild within 30 days. The U.S. CISA Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilities with confirmed evidence of active exploitation and is the de facto ground-truth label set for evaluating prioritization metrics; the Common Weakness Enumeration (CWE) classifies the underlying software-weakness type of a CVE (e.g. SQL injection, use-after-free). Several empirical studies, surveyed by Jiang et al. (2025), have documented that CVSS severity correlates poorly with observed exploitation, while EPSS discriminates exploitation far better but treats all exploited vulnerabilities as equally important. Sherif et al. (2026) therefore built a composite Key Risk Indicator (KRI), a term from operational risk management denoting a measurable quantity that tracks risk exposure, defined as the product of three normalized components: the EPSS score (threat), a CVSS severity weight with Low=1 to Critical=4 (impact), and a prevalence weight counting how often the CVE's CWE class appears among exploited vulnerabilities (exposure). Multiplicative aggregation follows an expected-loss rationale: if any factor is negligible, expected loss should approach zero. They evaluated all component combinations against the KEV catalog on 280,694 CVEs using Receiver Operating Characteristic area under the curve (ROC-AUC, discrimination averaged over all thresholds) and area under the precision-recall curve (AUPRC, the appropriate summary under extreme class imbalance since exploited CVEs are under 1% of the data), plus decision-centric measures such as expected remediation value (ERV): the fraction of an oracle's impact-weighted remediation benefit that a ranking captures within its top-$k$ entries. Their ablation found EPSS alone achieves AUPRC 0.365 versus 0.223 for the full KRI, yet KRI captures 92.3% of oracle impact-weighted value at $k=500$ versus 82.6% for EPSS, and KRI's net benefit exceeds EPSS whenever the Critical-vs-Low loss ratio ('severity premium') exceeds 2. These are exactly the claims that remain unvalidated outside the single retrospective snapshot: the study is cross-sectional (one point-in-time snapshot rather than per-CVE histories), KEV is known to underreport exploitation (especially undisclosed or targeted intrusions), about 15% of CVEs in their dataset lacked CWE classification, and the multiplicative form was chosen a priori rather than compared with alternatives on outcome data.

Problem Statement

Establish, with evidence beyond a single retrospective cross-sectional benchmark, whether impact-weighted composite vulnerability prioritization (of the form $\mathrm{KRI} = \mathrm{EPSS} \times \mathrm{CVSS\text{-}weight} \times \mathrm{CWE\text{-}prevalence}$ proposed by Sherif et al. 2026, where EPSS is the Exploit Prediction Scoring System daily-updated probability of exploitation in the wild within 30 days, the CVSS weight is a 1-to-4 severity weight derived from the Common Vulnerability Scoring System score, and the CWE-prevalence weight counts how often the vulnerability's Common Weakness Enumeration weakness class occurs among exploited vulnerabilities) genuinely outperforms exploit-probability-only (EPSS) and severity-only (CVSS) prioritization in reducing impact-weighted exploitation. The common objective uniting all components is an evidence base sufficient for a qualified reviewer to decide whether organizations should adopt impact-weighted composite indicators; specifically: (1) Longitudinal stability — construct per-CVE trajectories of EPSS, severity, and CWE-prevalence components from publication through eventual exploitation (e.g. entry into the Known Exploited Vulnerabilities (KEV) catalog, the U.S. CISA list of vulnerabilities with confirmed evidence of active exploitation that serves as the de facto ground-truth label set) and determine whether the impact-weighting advantage (in expected remediation value (ERV)-type impact-weighted measures, i.e. the fraction of an oracle's impact-weighted remediation benefit that a ranking captures within its top $k$ entries) is stable over the vulnerability lifecycle or an artifact of a static snapshot. (2) Exploitation-label completeness — quantify how KEV underreporting of exploitation (including undisclosed or targeted intrusions) biases absolute and relative performance estimates of prioritization metrics, and develop and validate a correction. (3) Aggregation form and label robustness — empirically compare multiplicative against additive, geometric-mean, and learned-weight aggregation using real remediation outcome data, including robust handling of CVEs lacking CWE classification (about 15% in the source dataset), and establish whether aggregation choices and learned weights generalize across organizations and asset contexts. (4) Operational effectiveness — integrate asset-level context (asset criticality, compensating controls, network exposure) to calibrate the composite score to organizational loss models, and test prospectively whether teams guided by the impact-weighted composite capture more impact-weighted remediation value per unit remediation effort than teams guided by EPSS or CVSS alone. The four components are jointly posed, each bearing on this same objective, and both clauses of component (3) are conditions of the aggregation-form analysis. Because organizational remediation outcomes and prospective team-deployment results are not publicly available and are not recoverable from the cited literature, components (3) and (4) are bounded by the obtainable evidence: the comparison of aggregation forms and the operational-effectiveness question extend as far as the available outcome and deployment data allow, and claims the obtainable evidence cannot test remain open. Answers must evaluate the stated objective itself, not a proxy restricted to agreement with the KEV catalog.

References

1. Emad Sherif, Iryna Yevseyeva, Vitor Basto-Fernandes, Allan Cook. Bridging the Gap Between Security Metrics and Key Risk Indicators: An Empirical Framework for Vulnerability Prioritization. arXiv:2603.12450, 2026. DOI: 10.48550/arXiv.2603.12450. https://arxiv.org/abs/2603.12450
2. Jay Jacobs, Sasha Romanosky, Benjamin Edwards, Idris Adjerid, Michael Roytman. Exploit Prediction Scoring System (EPSS). Digital Threats: Research and Practice, vol. 2, no. 3, 2021. DOI: 10.1145/3436242. https://doi.org/10.1145/3436242
3. Peter Mell, Jonathan Spring. Likely Exploited Vulnerabilities: A Proposed Metric for Vulnerability Exploitation Probability. NIST Cybersecurity White Paper NIST CSWP 41, May 2025. DOI: 10.6028/NIST.CSWP.41. https://doi.org/10.6028/NIST.CSWP.41
4. Damiano Ravalico, Mauro Farina, Martino Trevisan, Alberto Bartoli. Analysing the Temporal Dynamics of the Exploit Prediction Scoring Systems (EPSS). SSRN preprint, 2025. DOI: 10.2139/ssrn.5147459. https://doi.org/10.2139/ssrn.5147459
5. Amira K. Ellabad, Juma Ibrahim. Evaluating the Impact of Time-to-Exploit Estimation for Vulnerability Prioritization. Journal of Technology Research, vol. 4, no. 1, pp. 51–62, 2026. DOI: 10.26629/jtr.2026.06. https://doi.org/10.26629/jtr.2026.06
6. Stephen Shaffer, Laura Voicu. Modeling Local Exploit Hazard: A Bayesian Framework for Quantifying Exploit Risk and Operational Efficiency. arXiv:2607.24618, 2026. DOI: 10.48550/arXiv.2607.24618. https://arxiv.org/abs/2607.24618
7. Faruk Alpay, Taylan Alpay. Compute-Budgeted Exploitability Evidence Graphs for Prospective Vulnerability Triage. arXiv:2606.19076, 2026. DOI: 10.48550/arXiv.2606.19076. https://arxiv.org/abs/2606.19076
8. Yuning Jiang, Nay Oo, Qiaoran Meng, Hoon Wei Lim, Biplab Sikdar. A Survey on Vulnerability Prioritization: Taxonomy, Metrics, and Research Challenges. arXiv:2502.11070, 2025. DOI: 10.48550/arXiv.2502.11070. https://arxiv.org/abs/2502.11070
9. Yu Nong, Yao Du, Majid Behravan, Haipeng Cai. How Reliable Are NVD CWE Labels? A Large-Scale Semantic Audit with Seclometry. arXiv:2608.21977, 2026. DOI: 10.48550/arXiv.2608.21977. https://arxiv.org/abs/2608.21977
10. Haochen Liu, Zhengzhang Chen, Haoyu Wang, Yanchi Liu, Jundong Li, Haifeng Chen. HARP: Hierarchical Adaptive Ranking with Preference-Adaptive Fusion for Query-Based CVE Prioritization. arXiv:2608.19430, 2026. DOI: 10.48550/arXiv.2608.19430. https://arxiv.org/abs/2608.19430
11. Artur Balsam, Michał Walkowski, Maciej Nowak, Jacek Oko, Sławomir Sujecki. Automatic CVSS-Based Vulnerability Prioritization and Response with Context Information and Machine Learning. Applied Sciences, vol. 15, no. 16, article 8787, 2025. DOI: 10.3390/app15168787. https://doi.org/10.3390/app15168787
12. Zihan Kong, Yong Piao, Tianran Li. A Source Code Vulnerability Detection Method Based on Positive-Unlabeled Learning. 2024 6th International Conference on Robotics, Intelligent Control and Artificial Intelligence (RICAI), 2024. DOI: 10.1109/ricai64321.2024.10911761. https://doi.org/10.1109/ricai64321.2024.10911761
13. Kethan Kota, Manjunatha A, Sree Vivek S. CWE Prediction Using CVE Description: The Semantic Similarity Approach. Procedia Computer Science, vol. 235, pp. 1167–1178, 2024. DOI: 10.1016/j.procs.2024.04.111. https://doi.org/10.1016/j.procs.2024.04.111
14. Jong-Hoon Kim. A Study on Correlation Analysis of Multidimensional Vulnerability Metrics (KEV, EPSS, CVSS) and Decision-Making Models Based on Optimal Thresholds in Q1 2026. Journal of the Korea Academia-Industrial Cooperation Society, vol. 27, no. 7, pp. 903–910, 2026. DOI: 10.5762/kais.2026.27.7.903. https://doi.org/10.5762/kais.2026.27.7.903
15. Allen D. Householder, Jeff Chrabaszcz, Trent Novelly, David Warren, Jonathan M. Spring. Historical Analysis of Exploit Availability Timelines. 13th USENIX Workshop on Cyber Security Experimentation and Test (CSET 20), 2020. https://www.usenix.org/conference/cset20/presentation/householder
16. Haipeng Chen, Jing Liu, Rui Liu, Noseong Park, V. S. Subrahmanian. VEST: A System for Vulnerability Exploit Scoring & Timing. Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence (IJCAI-19), 2019. DOI: 10.24963/ijcai.2019/937. https://doi.org/10.24963/ijcai.2019/937
17. Yazdan Movahedi, Michel Cukier, Ilir Gashi. Predicting the Discovery Pattern of Publically Known Exploited Vulnerabilities. IEEE Transactions on Dependable and Secure Computing, vol. 18, no. 4, 2021. DOI: 10.1109/tdsc.2020.3014872. https://doi.org/10.1109/tdsc.2020.3014872