Which Vulnerabilities to Patch First: A Risk-Based Patching Playbook for Mid-Market Owners and Operators

Which Vulnerabilities to Patch First: A Risk-Based Patching Playbook for Mid-Market Owners and Operators

2026-10-16

The takeaway: Stop sorting your patch list by severity score alone. Ask four questions about each vulnerability: Can anyone on the internet reach the affected system? Is the flaw on CISA’s Known Exploited Vulnerabilities (KEV) catalog? Can attackers automate the exploit? Would it give them full control? Those are the four inputs the Cybersecurity and Infrastructure Security Agency (CISA) now uses to set federal patch deadlines under Binding Operational Directive 26-04 (June 10, 2026). Then use the free EPSS score to sort everything else.

Why patch order matters more than patch volume

Verizon’s 2026 Data Breach Investigations Report (DBIR), its newest edition, analyzed more than 22,000 confirmed breaches. It found exploiting vulnerabilities is now the most common way attackers get in: 31% of breaches with a known initial access vector, versus 13% for credential abuse. The same report found only 26% of KEV-listed vulnerabilities were fully remediated in 2025, down from 38% the year before, and the median time to full resolution rose to 43 days from 32 (Verizon 2026 DBIR Executive Summary).

Most teams aren’t lazy. They’re buried. A scanner can return thousands of findings, and “fix every critical” isn’t a plan when there are hundreds of criticals.

The severity score isn’t a risk score

CVSS (Common Vulnerability Scoring System) is the 0–10 number on most scan reports. It’s maintained by FIRST, the global forum of incident response teams, and its CVSS v4.0 User Guide says the base score measures “Severity, not Risk” and shouldn’t be used alone to assess risk. A 9.8 on an isolated test box can matter less than a 7.5 on your internet-facing VPN.

Step 1: Know what’s exposed

You can’t prioritize what you can’t see. BOD 26-04 requires federal agencies to tag assets by environment (production or development), exposure (public or internal), and type (server, application, or network device). Do the same in your asset list. If you don’t have one, start with everything that has a public IP address: firewalls, VPNs, remote access tools, web apps, and email gateways.

Step 2: KEV goes first

The KEV catalog is CISA’s list of flaws with reliable evidence of exploitation in the wild. To be listed, a flaw needs a CVE ID (the standard public identifier for a vulnerability), reliable evidence of active exploitation, and a clear fix such as a vendor update. Scanning activity or a published proof-of-concept alone doesn’t qualify. CISA says private companies aren’t bound by its directive but strongly recommends every organization prioritize KEV entries, and suggests patch tools that flag them automatically. FIRST’s EPSS guidance agrees: when a flaw appears on KEV, treat it as actively exploited regardless of its EPSS score.

Step 3: Borrow the federal clock

BOD 26-04’s remediation table turns the four questions into calendar-day deadlines. A few rows:

  • Internet-exposed, on KEV, total control: 3 days plus forensic triage, meaning a check for whether the system was already compromised.
  • Internet-exposed, on KEV, not automatable, partial control: 14 days.
  • Internet-exposed, not on KEV, not automatable, partial control: 60 days.
  • Internal, not on KEV, not automatable: fix at the next scheduled upgrade.

CISA publishes the automatable and technical-impact answers for every CVE through its Vulnrichment program, so you don’t have to research them yourself. The deadlines bind only federal civilian agencies. For a mid-market business, they’re a defensible starting point you can tune to your staff and risk appetite.

Step 4: Use EPSS for the long tail

Most findings won’t be on KEV. The Exploit Prediction Scoring System (EPSS), maintained by a FIRST special interest group, publishes a free daily probability that each CVE will see exploitation activity in the next 30 days. Three tips from FIRST’s own guidance:

  • Set thresholds lower than feels natural. FIRST tracks exploitation activity for roughly 1.5–3% of published vulnerabilities in any 30-day period, so a 50% cutoff skips almost everything. FIRST says the 90th percentile (a score of about 0.04) selects about as many vulnerabilities as a “CVSS Critical” rule, but picks them using threat data.
  • Don’t multiply scores. FIRST warns that multiplying EPSS by CVSS produces a number with “no interpretable meaning.”
  • Localize it. A high score matters only if the flaw is present in your environment, reachable by an attacker, and on a system with real consequences.

Step 5: When you can’t patch, change the facts

Under BOD 26-04, deadlines move as facts change. Taking a system off the internet pushes its deadline back, and a new KEV listing shortens it. CISA’s KEV guidance is to apply vendor updates, use mitigations or workarounds only as a bridge to the real fix, and remove end-of-life products that can’t be updated.

Step 6: Make it routine, not heroic

NIST’s patch management guide, SP 800-40 Rev. 4 (April 2022), frames patching as preventive maintenance and “a cost of doing business.” Track two numbers every month: how many KEV-listed flaws sit on internet-exposed systems, and the median days to close them. Put both in front of leadership the way you’d show overdue receivables.

Where outside help fits

If your scan reports are long and your team is small, a fractional CTO or CISO can stand up the asset list, set the patch clock, and build the monthly report so it runs without heroics. That work sits in the Secure pillar on what we do, and CIO vs CTO vs CISO explains who should own it. If your backlog keeps growing, start with a 20-minute call.

Internal links: What We Do, How We Engage, CIO vs CTO vs CISO, Contact, Insights.

Sources