Ep46: Vulnerability Prioritization: Why 98.5% of CVEs Are Never Exploited

Roughly 98.5% of all known CVEs have never been exploited. We break down a conversation between Jeremiah Grossman and Robert Hansen of Root Evidence, hosted by Raphael Mudge on Down the Rabbit Hole, and what it means for how you prioritize a patch queue: CVSS score vs. exploitation evidence vs. insurance-claims data, CISA's free KEV catalog, and why the vulnerability management industry has no incentive to tell you the truth.