EPSS vs. CVSS: Complementary, Not Competing
Why exploitation likelihood (EPSS) and severity (CVSS) answer different questions, and prioritization needs both.
Why It Matters
Using CVSS alone to prioritize a backlog systematically over-invests in high-severity-but-unlikely findings and under-invests in moderate-severity findings under active, real-world exploitation.
Application to Application Security
A dependency CVE with a high CVSS score but near-zero EPSS is a very different priority than one with a moderate CVSS score and a high, rising EPSS — the second is the one attackers are actually using right now.
Relation to Software Development
This is precisely the argument Strata makes in its own vulnerability-prioritization guidance: severity alone doesn't determine what to fix first, and combining it with exploitability and business context does.
How Strata Surfaces This
Strata calculates CVSS automatically for applicable findings; combining that with EPSS and business-context prioritization is the subject of Strata's dedicated prioritization article, linked below.
Developer guidance
Build a triage rule that combines both scores — e.g., high CVSS + high EPSS gets fixed this sprint, high CVSS + low EPSS gets scheduled, not dropped.
Management guidance
A prioritization framework that visibly combines severity and exploitability is easier to defend to stakeholders than "we fixed things in CVSS order," which invites the obvious follow-up: why wasn't the highest score first?