← GAVIN LUJAN · EXECUTIVE CYBER BRIEFS

VULNERABILITY MANAGEMENT · EXPOSURE · EXECUTIVE RISK

Stop patching the spreadsheet.

A vulnerability program should not ask only, “How severe is the CVE?” It should ask, “Is it being exploited, how likely is exploitation, can an adversary reach it, what mission asset sits behind it, and what action reduces the most risk now?”

CVSS describes technical severity. KEV confirms exploitation in the wild. EPSS estimates exploitation probability. Asset context tells us whether the finding matters here. The decision lives at the intersection.

OPEN SOURCE STACK

Build the signal yourself.

  • OpenVAS / Greenbone · network vulnerability discovery
  • Trivy · containers, filesystems, IaC and software supply chain
  • Grype · package/SBOM scanning with EPSS and KEV context
  • OWASP Dependency-Track · component and SBOM risk intelligence
  • DefectDojo · finding aggregation, normalization and remediation workflow

COMMERCIAL EXPOSURE MANAGEMENT

Buy the correlation layer.

  • Tenable VPR · dynamic vulnerability priority rating
  • Qualys TruRisk · asset and threat-informed risk prioritization
  • Rapid7 Active Risk · exploitability and environment-aware prioritization
  • Microsoft Defender exposure score · vulnerability posture and asset-context exposure scoring

THE OPERATING MODEL

From scanner noise to governed action.

01 · DISCOVERFind vulnerabilities across endpoints, servers, cloud, containers and applications.
02 · ENRICHAdd CVSS, CISA KEV, EPSS, threat intelligence, exploit maturity and reachability.
03 · CONTEXTMap asset criticality, identity, internet exposure, data sensitivity and mission dependency.
04 · PRIORITIZEEscalate exploited, reachable vulnerabilities on critical assets before merely high-scoring backlog.
05 · PROVERemediate, rescan, preserve evidence, track exceptions and report residual exposure.

This is the architectural shift from vulnerability management to exposure management. The scanner becomes a sensor, not the decision-maker. Governance consumes multiple signals and produces a defensible remediation queue.

EXECUTIVE CONTROL

A practical priority ladder.

P0: KEV or otherwise confirmed active exploitation + reachable critical asset. P1: high EPSS / credible exploit intelligence + exposed or mission-critical asset. P2: severe vulnerability with meaningful local exposure but weaker exploitation evidence. P3: lower-risk backlog, isolated assets, compensating controls, or findings awaiting validation. Do not mathematically mash unlike signals into a mystery number. Keep the evidence visible so the decision can be explained.

WHY NOW · 2026

Federal guidance is moving toward risk-based remediation.

CISA's 2026 BOD 26-04 explicitly directs federal agencies to prioritize rapid remediation of high-risk vulnerabilities while allowing lower-risk work to be deferred. CISA continues to position KEV as evidence of exploitation in the wild, while EPSS provides a complementary probability signal. Tenable also transitioned its enhanced VPR into exposure scoring in July 2026, and Microsoft introduced an updated exposure-score model that incorporates additional vulnerability-risk signals and asset context.

CISA KEV · FIRST EPSS · Greenbone · Trivy · Grype · OWASP Dependency-Track · DefectDojo