Lesson 6 of 15 · 6 min read
Vulnerability Management by Risk: CVSS, EPSS, KEV and Context
Vulnerability management decides what to fix first among thousands of findings. CVSS base scores rate theoretical severity; CISA's Known Exploited Vulnerabilities catalogue records confirmed exploitation; FIRST's EPSS estimates the probability of exploitation in the next 30 days. Combined with reachability (internet exposure, whether vulnerable code runs), asset criticality and attack paths, these produce tiers with remediation targets and documented risk acceptance. Programmes fix root causes such as base images and shared libraries, and measure exposure windows on exploited vulnerabilities rather than tickets closed.
free sign-in, no card required
Practise it as an interviewer asks it
What are the four functions of the NIST AI RMF, and how do you use each?How do you evaluate a claim that prompt injection has been solved?What is an AI use-case register, and how do you route use cases to controls?A startup shipped a chatbot with no governance. What do you set up first?What is the difference between a threat, a vulnerability and a risk, and how do you prioritise findings?A product team wants to ship an LLM feature next week, and the security review is not done. What do you do?