Machine-learning teams are used to arguing about which model deserves trust: the one with the strongest offline score, the one that is cheapest to run, or the one whose errors are easiest to live with. Security operations stage an almost identical argument every week, except that the candidates are scoring systems for software flaws and the stakes are measured in exposure time. Done well, this is the heart of VulnerabilityOps, and the comparison below treats each signal the way an evaluation report would: what it measures, where it misleads, and what it should be allowed to decide.
The contenders and what each one claims to know
Four inputs dominate modern triage. Severity scoring (CVSS) rates the technical gravity of a weakness in the abstract. A probability model (EPSS) estimates how likely exploitation is in the coming thirty days. A catalogue of confirmed abuse (KEV, maintained by the US cyber agency) lists flaws that have actually been used. Finally, decision trees (SSVC) combine a handful of situational facts into a named action. According to the Ops Atlas page for VulnerabilityOps, mature teams rank the first three as evidence over probability over severity, then let the tree or a published clock translate the result into a deadline.
That ordering will ring true for anyone who has weighed a labelled ground-truth set against a classifier output and a hand-written heuristic. Ground truth outranks the model, and the model outranks the heuristic.
Severity scoring: a clean input, a poor decision rule
CVSS version 4.0 arrived in November 2023 and is stewarded by the Forum of Incident Response and Security Teams, which has held that role since 2005. Its own documentation warns against treating a base score as a standalone risk verdict. The reason is easy to state in ML terms: the base score is a feature that ignores deployment context. It knows nothing about whether the vulnerable service faces the internet, whether code to exploit it circulates, or whether the asset matters.
The failure mode the Atlas names is a policy of “fix everything rated nine or above first, forever”. That rule is attractive because it is trivial to implement, but it treats a severity label as if it prescribed an action. The labels “critical” and “high” describe how bad a successful attack could be; they say nothing about whether anyone is trying.
EPSS: a calibrated model that people over-trust and under-read
EPSS appeared in April 2021 and, according to the Atlas, its model version 5 replaced version 4 on 15 June 2026. Two facts are worth carrying around. First, the base rate is low: somewhere between 1.5 and 3 percent of published flaws see exploitation activity in a given thirty-day window. Second, the scale is steeply skewed. A cutoff that mimics the effort of chasing every “critical” sits near the 90th percentile, a probability around 0.04, whereas treating everything rated “high and above” as urgent pulls in about the top 48 percent, with a probability near 0.008.
Anyone who has tuned a classifier on imbalanced data will recognise the lesson. A threshold chosen by label names rather than by precision-recall behaviour produces a long list that is mostly noise. The probability is useful because it lets a team pick a cutoff that fits its remediation capacity.
Two cautions follow. A small number is not a guarantee: five percent is roughly one chance in twenty of exploitation activity within a month, which is not the same as “safe”. And, more dangerous, teams are tempted to multiply EPSS by CVSS to obtain a single blended figure. FIRST itself refers to this practice as “Score Laundering”, because the product has no defensible unit and hides which input produced the number.
KEV: the only signal that is evidence
The Known Exploited Vulnerabilities list began in 2021 and stood at 1,748 entries as of mid-October 2026, with the agency aiming to refresh it within a day of new information. Its strength is that membership is based on observed abuse rather than on a forecast. Its weakness is coverage, since an absent flaw may simply be unobserved, and a caveat from the agency itself: listing an old flaw does not prove it is being exploited today.
In evaluation terms, KEV has high precision and uneven recall. That is a good property for a gate that triggers urgent work and a poor one for a catalogue of everything that matters.
SSVC and published clocks: from signal to action
Decision trees close the loop. The agency’s variant ends in Track, Track*, Attend or Act, while the CERT Coordination Center’s deployer tree ends in Defer, Scheduled, Out-of-Cycle or Immediate. The agency also publishes its tree outputs as an enrichment feed called Vulnrichment. Where severity bands once set deadlines, a June 2026 directive replaced them for US federal civilian agencies with clocks derived from four inputs: internet exposure, presence on the KEV list, how easily an attack can be scripted, and the size of the technical impact. The directive binds only those agencies, but its logic is a useful template for anyone else.
The defaults matter. When automatability is unknown the answer is “no”; when impact is unknown it is “total”. In other words, missing features fall back to the conservative value on the impact axis. Anyone who has handled missing values in a pipeline knows how much that choice shapes outcomes.
Side-by-side summary
- Severity score. Measures: potential damage in the abstract. Strength: stable, widely supported. Weakness: ignores context and attacker behaviour. Allowed to decide: input to a tree, never a deadline alone.
- Probability model. Measures: likelihood of exploitation activity within thirty days. Strength: scalable ranking to match capacity. Weakness: low scores invite complacency. Allowed to decide: review cadence for the long tail.
- Exploited catalogue. Measures: confirmed abuse. Strength: evidence-based. Weakness: partial coverage and possible staleness. Allowed to decide: the shortest clocks.
- Decision tree. Measures: situational fit. Strength: explicit and auditable. Weakness: needs accurate asset tags. Allowed to decide: the final tier.
Data quality is a hidden fifth contender
No comparison is complete without the dataset. The Atlas notes that since mid-April 2026 the US national vulnerability database fully enriches only those entries it prioritises. As of 17 October 2026 it listed 57,074 entries as “Deferred / Not Scheduled” and 7,563 awaiting enrichment. A pipeline that depends on enriched fields therefore sees gaps that look like safety. Europe’s own database, operated under the NIS2 framework, offers a second source worth reconciling.
The practical advice is the one any model owner would give: monitor input drift and missingness, and decide in advance how a record with absent fields is treated.
Where AI-assisted research fits
The earliest documented use of the term VulnOps, in an October 2025 essay, concerned operationalising AI-assisted vulnerability research, which means turning a stream of machine-found weaknesses into something an organisation can handle. That emphasis sits upstream of the flow described here. If discovery gets cheaper, arrivals rise, and the saturation ratio of arrivals to verified closures becomes the number that tells you whether the organisation is coping. For readers interested in the monitoring side of automation more broadly, our look at ten safety-monitoring options for robotic systems covers how to think about alerting that someone has to act on.
A recommended evaluation protocol
- Tag assets with exposure first. Without it the tree has no input; the Atlas suggests treating an untagged asset as public until proven otherwise.
- Match KEV daily and treat hits as the shortest clock.
- Use the probability model to choose a review threshold that your fixers can actually absorb, for example a weekly look at the top decile on internal systems.
- Let analysts promote a flaw to a higher tier but never demote one without a recorded reason.
- Close with evidence. A ticket status is a claim; an authenticated rescan or a rebuilt image digest is a measurement.
Teams that decide this way tend to find that the hardest part is not the scoring but the discipline of following it. As with any attempt to improve business decisions with data, the value comes from agreeing in advance which signal wins when two disagree.
Closing assessment
If you must pick one signal, pick evidence. If you can have two, add the probability model and tune its cutoff to capacity. If you can have three, keep severity as context only. And whichever combination you choose, publish the rule, because a ranking nobody can reproduce will not survive its first audit.