Triage Bugs Like a Pilot: Prioritize Exploits, Not Just Severity

The Misconception: Severity Equals Priority

We've all been in a triage meeting where someone waves a Critical-severity bug report and demands it be fixed now. That's wrong. Severity measures how badly a bug breaks the software; priority measures how urgently we must fix it. (Atlassian) Those are different axes. A crash in an obscure admin-only feature might be Fatal in severity, but if it's never used in production and no customer hits it, it's not urgent. Meanwhile, a Medium-severity issue that's actively exploited in the wild can burn the house down. So if your triage process is just "severity = priority," you're flying blind.

We should treat triage the way a pilot treats a cockpit warning: not every alarm means "eject now." Some are nuisance alerts; some indicate a fire in the engine. You need a system to distinguish them. That's what this article is about.

The Two Contenders: CVSS vs. KEV

When security bugs land in the tracker, two tools dominate triage: the CVSS score and CISA's Known Exploited Vulnerabilities (KEV) catalog. CVSS, maintained by FIRST, gives a numeric severity from 0.0 to 10.0, with Critical at 9.0–10.0. (FIRST) It's a great starting point, but it's a static snapshot. It tells you how bad a bug could be, not whether anyone is actually using it to break in.

The KEV catalog is different. It lists vulnerabilities that CISA has confirmed are being exploited in the wild, and each entry includes a remediation due date and whether it's tied to ransomware campaigns. (CISA) This is intelligence, not just analysis. If a bug is in KEV, it's not theoretical—it's happening right now. That's a different kind of urgency.

So which should drive your triage? Let's compare them on three concrete criteria: timeliness, actionability, and coverage.

Triage Criteria: Timeliness, Actionability, Coverage

Timeliness. CVSS scores are assigned when a CVE is published, but they don't change as the threat landscape evolves. The NVD re-assesses CVEs when new info arrives, but that lag can leave you chasing yesterday's news. (NVD) KEV is updated continuously as CISA learns of new exploits. In a triage meeting, KEV gives you a live edge.

Actionability. CVSS tells you a bug is bad, but not what to do about it. KEV comes with a remediation due date—a hard deadline. That's actionable. You can set a policy: "If it's in KEV, it gets fixed by the due date, no exceptions." That's a triage rule you can enforce.

Coverage. CVSS covers every CVE—there are tens of thousands, and the NVD enriches them all. (NVD) But most of those bugs aren't being exploited. KEV is a smaller, curated list—the ones that matter most right now. For triage, you want to focus on the 1% that are actually on fire, not the 99% that are just smoldering.

Here's a direct comparison:

In our shop, we use CVSS to set the initial severity, then overlay KEV to set priority. If a bug is in KEV, it jumps to the top of the list, regardless of its CVSS score. A Medium CVSS bug that's actively exploited beats a Critical CVSS bug that nobody's using.

Who Each Is For and the Verdict

CVSS is for everyone who needs a standardized severity metric—it's the common language in security advisories and the NVD. (NVD) But for triage, it's a starting point, not a finish line. KEV is for teams that want to prioritize based on real-world risk, not just theoretical impact. If you're a federal agency, CISA's BOD 22-01 (now superseded by BOD 26-04) required remediation of KEV items. (CISA) Even if you're not federal, you should adopt that mindset.

So which wins? KEV, hands down, for triage. But you need both. The truth is, you can't do triage without severity—you need to know how bad a bug is. But you can't prioritize without exploit intelligence. So the real answer is: use CVSS to set severity, KEV to set urgency.

Here's a concrete example. In the 2024 CWE Top 25, CWE-787 Out-of-bounds Write ranked #2 with a score of 45.20, and it had 18 CVEs in KEV. (CWE) Meanwhile, CWE-79 Cross-site Scripting was #1 with a score of 56.92, but only 3 KEV CVEs. (CWE) If you triage by severity alone, you'd fix XSS first. But if you triage by exploit activity, you'd fix the out-of-bounds writes first—they're being attacked more often. That's the difference KEV makes.

Quick tip: When a new CVE lands, check both the CVSS score and the KEV list. If it's in KEV, treat it as a P1, no matter what the severity says.

What I'd Actually Do

Here's my concrete plan: In our bug tracker, we have two fields: Severity and Priority. Severity is set by the reporter, but Priority is set by triage. For security bugs, we use a simple rule: if the CVE is in KEV, Priority = Highest. If not, Priority = based on CVSS score (Critical = High, High = Medium, etc.). We also add a mandatory triage step in the workflow, because without it, bugs get lost. (Atlassian)

And we don't stop at triage. We use the KEV catalog to drive our entire vulnerability management program, not just individual bugs. CISA says to use it as an input to your prioritization framework. (CISA) So we set a policy: every KEV item must be remediated by its due date, or we escalate to the incident response team. That's not just triage—that's survival.

In the end, the goal is to fix the bugs that matter most, not the bugs that look scariest. Triage isn't about severity; it's about risk. And risk is about what's being exploited right now. So stop treating every Critical like a five-alarm fire. Start treating every KEV like one.

Sources

• Atlassian - https://www.atlassian.com/software/jira/guides/issues/priorities
• FIRST - https://www.first.org/cvss/v4.0/specification-document
• CISA - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• NVD - https://nvd.nist.gov/general
• CWE - https://cwe.mitre.org/top25/archive/2024/2024_top25_list