AI-assisted vulnerability triage: KEV, EPSS and CVSS together

A security engineer's hardest daily question is not what is vulnerable, it is what to fix first. A raw feed of new CVEs, each with a CVSS score, is not a plan. Two vulnerabilities can both be rated critical while only one is being exploited in the wild. The KBrain CVE brain lets you triage inside the AI assistant you already use, combining three signals in a single question, from data that is refreshed daily rather than recalled from training.

Why CVSS alone is not enough

CVSS measures the potential impact of a vulnerability if it were exploited. It does not tell you whether anyone is exploiting it, or how likely that is to happen soon. A patch queue ordered by CVSS alone spends effort on high-impact issues that no attacker is touching, while a medium-scored bug under active exploitation waits its turn.

Two extra signals fix this. CISA KEV lists vulnerabilities that are known to be exploited right now. EPSS, the Exploit Prediction Scoring System, estimates the probability that a vulnerability will be exploited in the next 30 days. Read together, they turn a flat severity list into a real priority order.

The three signals, in one answer

• CISA KEV: is this being exploited today? If yes, it jumps the queue. This is the single strongest signal for urgency.
• EPSS: how likely is exploitation in the near term? A high EPSS score with no KEV listing flags something worth patching before it becomes a KEV entry.
• CVSS severity and vector: if it is exploited or likely to be, how bad is the impact and what is the attack path?

What triage looks like in practice

You paste a list of CVEs from a scanner report into Claude or ChatGPT and ask which to fix first. The assistant calls the CVE brain for each identifier, gets the KEV flag, the EPSS score, and the CVSS severity, and returns a ranked list with the reasoning attached. Because the data is current, a CVE added to KEV yesterday is treated as urgent today, not missed because the model was trained last year.

• Ask: "Of CVE-2024-3400, CVE-2024-21762 and CVE-2023-46805, which should I patch first and why?"
• Ask: "Show me this week's critical CVEs that are already in CISA KEV."
• Ask: "Is the EPSS score for this CVE high enough to justify an emergency change?"

Every answer carries a last-updated timestamp, so a triage decision can cite when the underlying data was current. That matters when the same question, asked to a generic model, would return a confident but stale or invented score.