3,000 Things to Fix and No Idea Where to Start
The ER doesn't call people in the order they arrived. It calls them in order of danger. When your vulnerability list runs thousands of lines long, that sorting is what EPSS does. Part 3 of the RMF·NIS2 series.
Something strange happens when you go to the emergency room. Someone who arrived after you gets called in first. You want to complain at the front desk. But the ER doesn’t call people in the order they arrived. It takes a quick look at each person’s condition, assigns a grade, and then calls them in order of danger. This is called triage. It’s French for “sorting out.”
What happens without triage? Someone with a sprained ankle goes ahead of a heart attack patient because they got there first. It looks like everyone was treated fairly, but in fact the person in the most danger was missed.
That’s exactly what happens to someone seeing security assessment results for the first time.
The list is long and you only have two hands
INFERRED Sweep a single cloud account properly and the list of things to fix runs from hundreds to thousands of lines. Open it up and every one of them looks like it needs fixing. But what you can actually get to this quarter is only a fraction of that. People and time are both finite.
At this point most teams work through it from the top down. That’s an ER calling people in the order they signed in.
“Severe” and “dangerous” are not the same word
FACT Vulnerabilities usually come with a severity score. CVSS, a public standard, rates them from 0 to 10. It measures how bad things get if you’re breached.
There’s a trap here. Severity only tells you how much it hurts — it says nothing about whether that’s actually likely to happen. In triage terms, it’s looking only at the weight of the symptoms without checking whether anything is in progress right now.
FACT EPSS is the metric that fills in that missing axis. Operated by FIRST, this public metric produces a number between 0 and 1 for the probability that a given vulnerability will actually be exploited in the near term. It’s calculated from observed attack data, and the score updates as the situation changes.
The two metrics aren’t in competition. They measure different things.
| What it measures | In ER terms | The question it answers | |
|---|---|---|---|
| CVSS | Severity | Weight of the symptoms | How much does it hurt if it goes off |
| EPSS | Exploitability | Is it in progress right now | Is it actually likely to go off |
If you remember the 5×5 scale from Part 2, the placement is immediately clear. EPSS is the vertical axis (likelihood), and the CVSS side is the horizontal axis (impact). The cell where the two axes meet is the real running order.
Which is how this happens: there are vulnerabilities with terrifyingly high scores that nobody touches in the real world, and vulnerabilities with middling scores whose attack tooling is already in circulation. Sort the list by severity alone and the latter get pushed down.
What RMF does
FACT SecurityHero RMF inspects assets, IAM, and networks with Prowler, then assesses exploitability with EPSS. This sorting is exactly what it does in the vulnerability management area — it moves the things that are actually likely to be exploited to the front.
FACT And that running order stays on the record. NIS2 Article 21 requires risk management measures to be documented and demonstrated in an audit, and RMF organizes assessment results into a basis for response, drawing on CIR 2024/2690 and the ENISA technical implementation guidance (June 2025).
INFERRED We take it that the awkward moment in an audit is the question “why hasn’t this been fixed yet.” What you need then isn’t an excuse but the basis for the judgment. Having “this patient was classified grade 3 and moved back” written on the ER record is an entirely different thing from simply having seen them late with no record at all.
Things to Note
- This post is not legal advice. Whether your company falls under NIS2, and how far you need to go before a supervisory authority considers it sufficient, cannot be answered here. That’s for legal experts to determine.
- There’s no single right answer for which score threshold to fix first. The baseline varies with each organization’s asset profile and the workload it can absorb. This post goes only as far as saying there are two axes.
- An RMF report is not a certificate. It’s supporting evidence used for submission and review. It does not include certificate issuance, incident reporting (NIS2 Article 23 and others), or legal representation.
Series contents
- Why You Need Security Paperwork to Sell into the EU
- Why “Risk Assessment” Sounds Harder Than It Is
- 3,000 Things to Fix and No Idea Where to Start ← this post
- How Do You Assess Anything Without Installing Anything
- What “Your Data Doesn’t Cross Borders” Actually Means
- Facing Multiple Countries with a Single Document