The Backlog Economics of 'Criticals First': 8.7 Evidence-Free Bugs per Real One
If you work CVSS-Critical vulnerabilities strictly worst-first, how much of that queue carries any exploitation evidence? Of 30,409 Critical CVEs, only 3,124 (10.3%) are in CISA KEV or score EPSS ≥ 0.10. The other 89.7% have no public exploitation signal — 8.7 evidence-free Criticals for every one with evidence. A reproducible look at the cost of severity-only triage.
TL;DR — A severity-first queue treats all 30,409 CVSS-Critical CVEs as the top tier. We asked how many of them carry any public exploitation signal — either presence in CISA KEV or an EPSS probability of at least 0.10. The answer: 3,124 (10.3%). The remaining 27,285 (89.7%) have neither. That's 8.7 evidence-free Criticals for every one with exploitation evidence, all sharing the same top-priority bucket. The cost of severity-only triage isn't that it's wrong about severity — it's that it can't tell the 3,124 apart from the 27,285.
The queue nobody can finish
"Work the Criticals first" sounds disciplined until you count the Criticals. There are 30,409 of them (CVSS v3 ≥ 9.0) across 370,431 published CVEs. No team clears a backlog that size worst-first; they get some distance down it and stop. So the real question isn't "is severity a valid signal" — it's what fraction of the effort a severity-only queue spends is aimed at bugs with any sign of being exploited.
We define "has exploitation signal" generously — a Critical counts if it meets either bar:
- it's in CISA KEV (observed exploited in the wild), or
- its EPSS score is ≥ 0.10 (a meaningful modeled probability).
The result
| Critical CVEs (CVSS ≥ 9.0) | count | share |
|---|---|---|
| With exploitation signal (in KEV or EPSS ≥ 0.10) | 3,124 | 10.3% |
| No exploitation signal (not KEV and EPSS < 0.10) | 27,285 | 89.7% |
| Total Critical queue | 30,409 | 100% |
Evidence-free-to-evidence ratio: 8.73 to 1. For every Critical a team works that has real exploitation evidence, roughly nine sit in the same tier with none. A worst-first walk through the Critical queue spends the overwhelming majority of its attention before signal and noise are ever separated — because severity, the only sort key, rates all 30,409 as equally urgent.
The fix isn't to abandon severity; it's to reorder. Those 3,124 evidence-bearing Criticals are a queue a team can actually finish. Pull them to the front — by scoring exploitation signal alongside severity — and the first 10% of the work covers 100% of the Criticals that any public evidence flags as pressing.
What a blended score buys, concretely
This is the operational case for risk-based prioritization. A severity-only queue and a
signal-aware queue contain the same 30,409 findings; they differ only in order. But
order is the entire product of a triage system. Zennoxa Shield's Priority Engine ranks
by CVSS·0.30 + EPSS·0.30 + KEV·0.25 + reachability·0.15, so the 3,124 measured here
float toward the top and the 27,285 settle below — same list, radically different first
page. The tie is category-level and honest: the ratio above is computed from public data
and holds regardless of which tool consumes it. It simply quantifies what reordering is
worth.
Reproduce it yourself
- Pull the NVD
cvssV3Severity=CRITICALuniverse (30,409 at the 2026-07-27 snapshot). - Join EPSS (
epss_scores-current.csv.gz, model v2026.06.15 / 2026-07-26) on CVE ID. - Mark KEV membership (catalog 2026.07.24).
- Count Criticals meeting
in KEV OR epss >= 0.10; the complement is the evidence-free queue; divide for the ratio.
Limitations, stated plainly
- EPSS ≥ 0.10 is a generous bar for "signal." Raise it and the evidence-bearing set shrinks further, making severity-only triage look worse, not better — so 10.3% is a conservative estimate of the useful fraction.
- KEV is a floor, so some evidence-free Criticals are surely exploited without public confirmation. The ratio is therefore an upper-bounded estimate of waste, not an absolute.
- This is about ordering, not dismissal. Nothing here says the 27,285 should be ignored — only that they shouldn't crowd out the 3,124 at the top of the queue.
FAQ
Doesn't "89.7% evidence-free" just restate the severity-illusion finding? It's the same population viewed as a queue. The severity-illusion study measures how much of the Critical bucket lacks signal; this one frames the cost — the 8.7-to-1 ratio a worst-first triage pays before signal and noise are separated.
Is EPSS ≥ 0.10 the right cutoff? It's a deliberately generous one, chosen so the "has signal" set is as large as plausible. Stricter cutoffs only sharpen the conclusion.
So should we stop triaging by severity? No — blend it. Severity is one of four inputs in a risk score. The point is that severity as the sole sort key can't distinguish the 3,124 from the 27,285, and reordering by added signal is what makes the queue finishable.
What data is this based on? Public NVD CVSS scores, the FIRST EPSS current-scores file, and the CISA KEV catalog — reproducible from the pinned snapshots above.