A list of findings is not yet a priority

Monday morning. The vulnerability scanner reports four thousand findings, six hundred of them critical. The penetration test report with forty findings sits in the inbox. The attack surface analysis shows a dozen services reachable from the internet. Each of these lists is correct. Together they cannot be worked through, not this quarter and not the next.

The usual answer is to sort by CVSS score, from top to bottom. It feels methodical and still often passes the right place first.

What the law requires

The German BSI Act, which implements NIS2, lists the minimum content of risk management in Section 30(2). Two of them concern exactly these lists. No. 5 requires security measures in acquisition, development and maintenance (our translation)

"including vulnerability handling and disclosure"

and No. 6 (our translation)

"policies and procedures to assess the effectiveness of risk management measures in the field of information security"

Management, not complete elimination. And paragraph 1 already names, among other things, the degree of exposure to risk as a yardstick for proportionality. What is required is a justified order and evidence that it works.

Why CVSS alone sorts wrongly

The CVSS score describes how severe a vulnerability would be if exploited. It does not say whether it is being exploited. There are two public signals for that: the Known Exploited Vulnerabilities (KEV) catalogue of the US agency CISA and the Exploit Prediction Scoring System (EPSS) by FIRST, which estimates the probability of exploitation.

A vulnerability with CVSS 7 that is being actively exploited belongs ahead of one with CVSS 9.8 for which no attack is known. And both belong further back if the affected system is neither reachable nor supports an important process.

Five stages instead of a list

Continuous threat exposure management, CTEM for short, is not a tool but a cycle of five stages, described by Gartner in 2022:

• Scoping: What matters to us? Systems are grouped by business process, site or group and rated by criticality.
• Discovery: All sources are brought together instead of reading each on its own.
• Prioritisation: Actual exploitation before likelihood before severity, weighted by the importance of the system.
• Validation: Is the finding really exploitable here? Proof from a penetration test weighs more than a scanner hit.
• Mobilisation: Remediation with owners and deadlines, followed by measuring whether exposure has gone down.

The last stage is what Section 30(2) No. 6 is about: not the number of closed tickets, but whether the situation has improved.

How isidaten represents this

Exposure management reads the available sources together every night, for example CVE matches, attack surface findings, Greenbone and penetration test findings. A source that could not be read on a given night closes no findings, because it has proven nothing. Priority follows the order KEV before EPSS before CVSS, an available patch raises it, and an exploit proof from a penetration test counts as a signal of its own. A system's score is a decaying maximum: the highest finding counts fully, the second half, the third a quarter, so that a single critical hit never gets lost in the mass. Validation evidence expires, and highly exposed systems without valid evidence appear as a gap.

The check question

Which three of your open vulnerabilities are actually being exploited right now, and on which systems are they?

If the answer is in a table sorted by CVSS, you have a list of findings. That is not yet a priority.

Sources

BSI Act (BSIG), Section 30(1) and (2) No. 5 and 6 (German). CISA Known Exploited Vulnerabilities Catalog. FIRST, Exploit Prediction Scoring System (EPSS).