The patching rule that beats "just do the criticals"

30 July 2026 · Carl Heaton · Security Deep dive

Almost every security standard tells you to patch by severity. Cyber Essentials says fix anything scored 7 or above within 14 days. Most vulnerability tools sort by the same number. It is the obvious rule, it is written into the frameworks, and on the evidence it is close to the worst way to spend a small business's limited patching time.

We analysed 248,176 public vulnerability records against CISA's Known Exploited Vulnerabilities catalogue (KEV), the list of flaws confirmed as being used in real attacks. The question was simple: if you can only act on some vulnerabilities, which selection rule catches the most of the ones that actually get exploited?

The numbers

Five rules, tested against 1,758 confirmed-exploited vulnerabilities. Recall is the share of exploited flaws the rule catches. Precision is the share of what it hands you that was ever exploited.

Rule	Things to patch	Exploited flaws caught	Recall	Precision
CVSS 7 or above	89,697	1,428	81.2%	1.6%
EPSS 0.1 or above	3,513	1,260	71.7%	35.9%
Both together	2,873	1,119	63.7%	39.0%
EPSS 0.5 or above	1,506	860	48.9%	57.1%
CVSS 9 or above	20,491	570	32.4%	2.8%

Read the top two rows against each other, because that is the finding. Patching everything scored 7 or above means working through 89,697 items to catch 81% of the flaws that matter. Patching everything with an EPSS score of 0.1 or above means working through 3,513 items to catch 72%.

That is 25 times the workload for nine and a half percentage points more coverage. The severity rule hands you a list of which 98.4% were never exploited by anyone. The other rule hands you a list of which more than a third were.

And look at the bottom row. "Just do the criticals", the rule most small businesses actually follow when the list gets long, is the worst performer in the table. It catches under a third of what gets exploited, while still giving you 20,491 things to do.

What EPSS is, and why you probably have not heard of it

CVSS, the Common Vulnerability Scoring System, scores how bad a flaw would be if someone exploited it. It is a severity rating. It says nothing about whether anyone will.

EPSS, the Exploit Prediction Scoring System, is a different measure entirely. It is a probability, between 0 and 1, that a given vulnerability will be exploited in the wild in the next 30 days. It is maintained by FIRST, the same body behind CVSS, it is free, and it is published for most vulnerabilities that matter.

An EPSS of 0.1 means roughly a one in ten chance of being attacked in the next month. That is the threshold in the table above, and it is deliberately low. Raise it to 0.5 and your list drops to 1,506 items with a precision of 57%, better than a coin flip on a list you could work through in a fortnight.

The reason severity and probability diverge so sharply is that they answer different questions. A flaw can be genuinely catastrophic in theory and require physical access to a device nobody owns. The severity score is high. The realistic chance of it being used against you is near zero.

The honest caveats

Three, and we would rather state them than have you find them.

EPSS is trained partly on exploitation evidence that overlaps with KEV, the list we measured against. Some of its advantage in this table is therefore circular. It is a genuine forward-looking prediction rather than a lookup of the answer, so this inflates the effect rather than manufacturing it, but it does inflate it.

EPSS covers about half the records we analysed. Vulnerabilities without an EPSS score are invisible to the EPSS rules, which flatters their precision.

KEV is a floor, not a census. It is what one agency has confirmed and published, mainly for US federal remediation. Plenty of exploitation never reaches it, so every recall figure here is measured against an undercount.

Grant all three and the workload gap is still 25 to one. It is far too large to be explained away.

What to do with this

Do not throw out the severity rule if you are certifying against something. Cyber Essentials asks for CVSS 7 and above inside 14 days, and an assessor will check that, not this article. Meet the standard.
Use EPSS to order the work inside it. The framework tells you what must be done. Nothing stops you doing the likely-to-be-exploited ones first. On a 90,000-item list, order is the entire game.
Check EPSS before you panic about a headline score. A 9.8 with an EPSS of 0.001 is not tomorrow's emergency. A 6.5 with an EPSS of 0.6 might be.
Ask your provider which they sort by. If your IT supplier or managed service sorts your patch queue by CVSS alone, that is worth a conversation. It is not wrong, it is just very expensive.
Do not treat KEV as a to-do list either. Most of what is in it is enterprise and specialist software a small business does not run.

How Steelwise can help

Working out which of this actually applies to what you run, and what a sensible patching rhythm looks like for a business without a security team, is the kind of thing we do in a security review. Get in touch.

About the data. Figures come from our analysis of 248,176 public vulnerability records sourced via StackFlag, which is a Steelwise product. The underlying data is public: the National Vulnerability Database, CISA's Known Exploited Vulnerabilities catalogue, and GitHub Security Advisories. We have published the caveats above because they are real, including the ones that weaken the finding.

If you spot an error in this filing, tell us and we will correct it and note the change.