Less panic patching, more precision

In this newsletter, Thor breaks down why you should stop relying solely on CVSS and start using EPSS and GCVE to focus your patching efforts on the threats that actually matter.

Welcome to this week's edition of the Threat Source newsletter.   Recently, Martin closed his introduction with a  warning : Ready or not, the time of much patching is coming.  I've been chewing on that one for a while because I'm rethinking my own enrichment pipelines along these lines, and the questions Martin raised are the ones I keep running into — with one or two ideas on what practitioners can actually do about it.   Honestly speaking, most of us are still prioritising the wrong way.

CVSS has been the default for over a decade — but it only answers one question: How bad could this be in theory?  It's a severity score, not a risk score.