As reported by SecurityAffairs, the industry is increasingly recognizing what seasoned practitioners have long argued: CVSS scores alone are an insufficient basis for remediation prioritization. The article outlines a workflow combining CVSS, EPSS, and business context — and the data behind this shift is compelling. According to a Pentest-Tools.com survey of 158 practitioners, 68.4% report that a 500+ finding set would strain or overwhelm their teams, and 81.7% encounter AI-generated findings requiring significant manual validation.

Key Insight: As reported by SecurityAffairs, the industry is increasingly recognizing what seasoned practitioners have long argued: CVSS scores alone are an insufficient basis for remediation prioritization.

Shield53 has observed this exact pattern across client engagements. Organizations receive dense pentest reports and default to sorting by CVSS descending — fixing every 9.8 before touching anything rated 6.5. This mechanical approach creates dangerous blind spots.

The Scoring Trap

CVSS measures technical severity in a vacuum. It doesn't know if the vulnerable asset is internet-facing, what data it processes, whether compensating controls exist, or whether threat actors are actively exploiting the specific flaw. A 9.8 RCE on an isolated internal host behind segmentation and strong authentication is theoretically severe but practically low-risk. A 6.5 BOLA on a public payment API handling live transactions is an existential threat.

The question isn't 'how bad could this be?' — it's 'how bad is this given who can reach it, what they get, and whether someone is already trying?'

The Three-Lens Prioritization Model

Effective remediation requires three lenses applied simultaneously:

The Scoring Trap
Technical severity (CVSS): What is the maximum potential impact if fully exploited?
Exploitability (EPSS): How likely is active exploitation within a realistic timeframe?
Business context: Is the asset exposed? What data or processes does it touch? What are the regulatory and financial consequences of compromise?

Only findings scoring high across all three dimensions should be treated as immediate priorities. Findings with high CVSS but low EPSS and limited exposure can be scheduled into normal patch cycles with documented justification.

Validation Remains Non-Negotiable

The 81.7% figure for AI-generated findings needing significant manual validation is a critical signal. Automated tools — AI-powered or otherwise — produce noise. Treating unvalidated scanner output as ground truth is how organizations waste thousands of hours chasing phantom vulnerabilities or, worse, miss genuine exposures buried in false positives.

Every finding that drives remediation work should have a concrete proof-of-concept or reproducible evidence attached. If it can't be demonstrated, it shouldn't automatically consume engineering bandwidth.

Documenting the 'No'

One point from the SecurityAffairs piece deserves emphasis: documenting every deprioritization decision is as important as documenting what you fixed. When you choose not to remediate a 9.8 finding because the affected system is decommissioned next quarter, that decision record is your audit trail. Regulators, boards, and incident responders will all want to know why a known vulnerability remained unpatched. Undocumented risk acceptance is indistinguishable from negligence.

Shield53 Recommendations

  • Build a risk matrix that cross-references CVSS, EPSS, asset criticality, and exposure level. Score each finding across all four dimensions and rank by composite risk, not raw CVSS.
  • Mandate validation before remediation: Require reproducible PoCs for any finding estimated at more than 2 hours of engineering effort. If the tester can't demonstrate it, de-prioritize until confirmed.
  • Implement exposure-aware asset inventory: You cannot assess business context without knowing which assets are internet-facing, what data they handle, and which business processes depend on them.
  • Create a formal deprioritization register: For every finding you choose not to fix immediately, record the rationale, the compensating controls, the planned revisit date, and the approver. This is your evidence.
  • Set SLAs by composite risk tier, not CVSS band: A finding with CVSS 9.8 / EPSS 0.1% / internal-only might warrant a 30-day SLA. A finding with CVSS 7.1 / EPSS 80% / public-facing should trigger an emergency patch cycle.
  • Reassess quarterly: EPSS scores and threat landscapes shift. A finding deprioritized in January may become critical by March if a public exploit drops. Build re-evaluation into your workflow.

The organizations that manage post-pentest remediation effectively aren't the ones with the highest patch velocity — they're the ones who can articulate, with evidence, exactly why they fixed what they fixed and why the rest was an acceptable risk.