Patch by Proof, Not by Queue: Prioritizing Vulnerabilities by Live Exploitation (Starting with Your Edge)
Most patch queues are sorted by CVSS score. A flaw rated 9.8 gets fixed before one rated 7.5, and nobody asks whether either is being used. That matters, because a 7.5 that criminals exploit every week can sit behind a 9.8 that no one has touched. Vulnerability prioritization is how teams fix that order.
The 2026 Verizon Data Breach Investigations Report puts exploited vulnerabilities at 31% of initial access, the top route in, ahead of phishing and stolen credentials. The same report found that critical flaws on CISA’s KEV catalog took a median of 43 days to fix.
The better order starts with proof that attackers are using a flaw, and then asks how exposed the system is. Firewalls, VPN gateways and other edge devices sit at the exposed end, which is why they get most of the attention below.
The Two Habits That Keep Exploited Flaws Open
Both habits make sense on paper. A score is quick to sort by, and a monthly window suits change approvals, so most teams lean on both. Neither one looks at what attackers are doing, and that is the part vulnerability prioritization adds.
What a CVSS score leaves out
CVSS rates a flaw on its technical traits, such as how it is reached and how much damage it can cause. The score is calculated once, for everyone. It can’t tell you whether attackers have started using the flaw, or whether the affected system in your network faces the internet or sits deep inside it. Those two facts change the real risk a lot. A score is fine for judging impact, but it shouldn’t be the only sorting rule.
Why a fixed monthly window leaves exploited flaws waiting
Attackers don’t work to a calendar. A flaw that goes public on the third waits for the next window, whether it is quiet or already in use. And when the batch is too large to finish, severity order decides what slips, so an exploited flaw with a modest score can be pushed to next month. CISA, citing the 2026 Verizon report, says only 26% of KEV-listed flaws were fully fixed in 2025, down from 38% a year earlier.
Vulnerability Prioritization Starts With Evidence of Real Attacks
Risk-based vulnerability management relies on four kinds of evidence, and each one has a blind spot.
Source | What it tells you | What it cannot tell you |
Attackers have used this flaw in real attacks | Whether your own systems were hit, or whether your setup is affected. Some exploited flaws aren’t listed yet | |
A score from 0 to 1 for how likely exploitation is within about a month, refreshed every day | Business impact, or what will happen with one specific flaw | |
Threat intelligence and advisories | Attacks reported by vendors, researchers and national CERTs such as CERT-In | How reliable a report is, so check the source first |
Asset context | Whether a system faces the internet, how critical it is, who owns it and what protects it | Anything about attackers, and it is only as good as your inventory |
A KEV entry only matters if the affected product runs in your environment. A low EPSS score doesn’t make an exposed firewall safe. The sources become useful when you read them together.
Risk-Based Patch Management in Three Groups and Two Lanes
Evidence only helps when it leads to a decision. For every new advisory or KEV entry, first check whether the affected product and version run in your environment. If they don’t, note it and move on. If they do, the finding lands in one of three groups.
- Group 1, confirmed exploitation. KEV, a vendor advisory or credible intelligence shows live attacks on a product you run. It goes straight to the emergency lane, where the named approver makes the call. CVSS still helps judge impact.
- Group 2, exposed edge devices and critical assets. These are systems reachable from the internet, such as firewalls and VPN gateways, plus anything holding critical data, where an advisory has appeared but attacks aren’t confirmed. A critical or high-severity advisory, or a high EPSS score, starts an urgent assessment by the security lead and the asset owner. If exploitability, exposure and impact justify it, the finding moves to the emergency lane. If not, it goes to the routine one.
- Group 3, everything else. It follows the normal change process in the routine lane, ordered by severity, EPSS, asset importance and the controls already in place.
CISA’s Binding Operational Directive 26-04,issued in June 2026, follows a similar idea for US federal civilian agencies. It asks four questions about exposure, KEV status, automated exploitation and attacker control, and attaches a deadline to each pattern of answers. It binds those agencies only, so for everyone else it is a reference point.
Edge devices are the part of Group 2 that most often needs the emergency lane, so they come next.
Why Firewalls, VPNs and Other Edge Devices Belong in the Emergency Lane
They can be reached from the internet
Anyone online can try to reach an exposed edge device, and nobody has to click anything for an attack to begin. Whether it works still depends on the flaw and how the device is set up. In Verizon’s 2025 report, edge devices and VPNs accounted for 22% of the breaches in its vulnerability exploitation category, up from 3% the year before. That is one year and one breach type, so it says little about attacks overall.
They sit on the remote access path
A firewall or VPN gateway usually stands between remote users and internal systems, and depending on the setup it may also hold configuration, certificates or stored credentials. Take it over and the attacker starts from a spot the network already trusts. Setups vary, so list what each device in your estate holds and connects to.
Patching them often means downtime
An upgrade can cut access for everyone behind the device, so teams wait for a quiet window, though the reasons for delay differ from one organisation to the next. The same Verizon report shows how that plays out. Just over half of edge device vulnerabilities, 54%, were fully fixed, and the median fix took 32 days.
A patch does not remove an intruder who is already inside
A patch closes a known flaw and nothing more. An account the attacker created, a changed setting or a hidden way back in all survive it. After patching an exposed edge device, check admin accounts, configuration changes and VPN logs, and reset the credentials the device holds. Treat these checks as part of vulnerability remediation. CISA’s BOD 26-04 adds a forensic triage step to its most urgent tier to check whether a system was already compromised.
How Each Patch Lane Handles Speed, Approval and Rollback
A rapid patching strategy only works if the rules are agreed before an alert arrives. The timings below are examples, so set your own with your risk owners, based on your systems and maintenance windows.
Factor | Emergency lane | Routine lane |
Who enters | Group 1, plus Group 2 findings that are exploitable, reachable and high impact | Group 3, plus lower-risk Group 2 findings |
Target time | Set by policy and as short as the change window allows. CISA’s tightest federal tier is three calendar days | Set by risk. CISA’s lower federal tiers are 14 and 60 days |
Approval | One named approver agreed in advance, with a deputy | Normal change board |
Before the change | Configuration backup, previous firmware kept, standby unit or failover ready | Standard backup |
Testing | Focused test on a standby or test unit | Full test cycle |
After the change | Confirm the version, rescan, test remote access and check for signs of earlier compromise | Standard check |
Rollback needs a decision in advance too. Agree the point at which the team reverses a change, for example when remote access stays down past a set time, and who makes that call. If even the emergency target can’t be met, the next section applies.
Compensating Controls for When a Patch Has to Wait
These controls cut exposure while a fix is prepared. They don’t replace it, and how well they work depends on the flaw, so check the vendor advisory first.
- Restrict the management interface to trusted IP addresses or an internal network, and make sure administrators can still get in.
- Turn off the affected feature, but only if the advisory allows it and the business doesn’t rely on it.
- Apply the vendor workaround, or an intrusion prevention rule that blocks the known exploit pattern, where one exists.
- Tighten segmentation behind the device so one compromise can’t spread far.
- Name one person to review device and login logs until the fix is in.
Then test from outside that each control works, for example that the management interface no longer answers, and record the exception with an owner, an approver and an expiry date. An auditor or a board will find that record far easier to accept than exposure nobody wrote down.
A Weekly Routine for Small and Mid-Sized IT Teams
Smaller teams rarely have a patching platform or round-the-clock staff, but vulnerability patch management still fits them. Begin with a list of every firewall, VPN gateway, remote access tool and mail gateway reachable from outside, including old devices nobody remembers. An external scan will show what is really visible and may turn up devices missing from your records.
Then give one named person 30 minutes a week to check KEV updates and vendor advisories for those products. A match goes straight to the emergency lane. Everything else follows the routine lane, and moves up if new evidence of attacks appears.
Last, agree an out-of-hours maintenance window for edge devices with the business owner now, so an urgent patch doesn’t open with a negotiation. A spare or standby unit helps too, if the budget allows. The team can patch one device while the other carries traffic, and has a quick way back if the patch goes wrong.
Make the Patch Decisions Before the Alert Arrives
Most of the delay in an urgent patch comes from questions nobody answered in advance. Settle who approves an emergency change, how a bad patch is reversed and how the fix will be confirmed. Then try a dry run on a low-risk device.
Progression’s cybersecurity services team can help you turn this into routine. Its network security specialists can review how your firewalls and VPN gateways are set up, and its SOC can watch them for signs of attack, so every urgent patch has preparation and monitoring behind it.
If a new KEV entry matched your firewall tonight, who would approve the change, and how long would it take?
Frequently Asked Questions
1. What is risk-based vulnerability management?
Risk-based vulnerability management is a way of deciding which security flaws to fix first by looking at risk, not just a scanner’s ranking. Teams check whether attackers are using a flaw, how exposed the system is and how much the business depends on it. Vulnerability prioritization is the step that sets the order.
2. What is the difference between CVSS, EPSS and KEV?
CVSS rates how serious a flaw could be. KEV lists flaws that attackers are already using. EPSS estimates how likely exploitation is in the next 30 days. Teams use KEV to spot urgent items, EPSS to rank the rest and CVSS to judge impact.
3. How do you decide which vulnerabilities to patch first?
Begin with flaws that show proof of live attacks on products you run. Then look at internet-facing systems such as firewalls and VPN gateways, and at critical business systems. The rest can wait for a regular cycle, ordered by EPSS, severity and the controls already protecting them.
4. How long should it take to patch a critical or actively exploited vulnerability?
There is no single deadline for every organisation. CISA’s BOD 26-04 gives US federal agencies as little as three days for the highest-risk flaws, and other organisations can use that as a reference point. Set your own targets by exposure and impact. If the patch cannot go in on time, apply a workaround first and fix it as soon as possible.
5. Why are firewalls and VPNs such common targets for attackers?
They face the internet, so attackers can try to reach them directly, and they often sit on the remote access path into the network. Verizon’s 2025 report found that edge devices and VPNs were the target in 22% of vulnerability exploitation actions, up from 3% the year before. That makes a flaw on one a direct route to attempt entry.
