Exploit chains are being "weaponized" faster, with mass scanning and rapid follow-up by ransomware and espionage groups. Prioritize based on what is exploited in the wild and on internet exposure, not on CVSS alone.
Typical signals
- RCE attempts on edge appliances, VPNs, gateways, CI tooling
- Exploit fingerprints in WAF/IDS, webshell drops, suspicious cron jobs
- Mass scanning spikes for brand-new CVEs
Current-state check
- Drive patching on KEV/EPSS + exposure; automate where possible
- Segment "edge" and management planes; restrict admin interfaces
- Tie vuln management to threat intel + incident data
