ForenShield Lab · CVE Lab
You cannot patch everything: decide where to start
Six fictional vulnerabilities, a single maintenance window this week. Compare the scores, adjust the context of your estate and build a plan you can defend.
- ≈ 10 min
- No account
- Fictional data
Outline
What you will do
Compare the vulnerabilities
CVSS, EPSS and KEV catalog presence, side by side.
Adjust the context
Exposure, criticality, compensating controls: watch the ranking move.
Build the plan
Split the fixes between immediate, 7 days, 30 days and scheduled.
Defend your choices
Your plan is compared with a reference, gap by gap.
Key takeaways
What you will learn
- Understand what CVSS, EPSS and KEV measure
- See why a high score is not enough to decide
- Take real exposure and criticality into account
- Justify a remediation plan
On real data
Then move on to the real tools
The simulation is for practice. For your own data, use the tools designed for that purpose.
Frequently asked questions
Before you start
Do these vulnerabilities exist?
No. Their identifiers, products and scores are made up for the exercise. For real flaws and up-to-date data, see the site’s CVE database.
What do CVSS, EPSS and KEV measure?
CVSS describes the technical severity of a flaw. EPSS estimates the probability that it will be exploited within 30 days. CISA’s KEV catalog lists flaws with observed exploitation. These three pieces of information complement each other.
Is the priority calculation a standard?
No. It is a teaching formula, spelled out in full, to show the effect of context. In real life, adapt the method to your organization.