EPSS

A critical CVSS score tells you that a vulnerability could cause serious technical harm. It does not tell you whether that vulnerability represents your organisation’s greatest business risk. Effective prioritisation requires evidence of exploitation, asset context, control effectiveness and an understanding of the potential financial loss.