Severity-first vulnerability triage just lost its safety net

The default just lost its safety net

Since 15 April 2026, NIST has stopped scheduling every CVE for immediate CVSS enrichment — now it fast-tracks only the CISA KEV, federal, and EO-14028-critical slice, an estimated 15–20% of annual volume. Meanwhile FIRST and NIST have said for years that CVSS measures severity, not risk. And in June, CISA replaced its own flat KEV-deadline rule (BOD 22-01) with a four-variable risk model, BOD 26-04.

Put those three facts together and the industry's default sort key — rank by CVSS, work down the list — is broken on every axis: the data feeding it is thinning, the number was never a risk measure to begin with, and even the agency that popularized flat deadlines has abandoned them.

Evidence-tiered scoring, not severity-first

We think the fix is to weight vulnerability signals by the strength of the evidence behind them, not by severity alone: treat confirmed exploitation (CISA KEV) as a hard override, not a weight; let predicted likelihood (EPSS) carry the probability term; cap severity (CVSS) as a consequence ceiling rather than a sort key; and let context — reachability, business criticality — adjust the result but never invent risk that isn't there.

That's the design behind DriftScore, RiskScore, and DriftRisk™ — and it's also the argument we just published in full.

The whitepaper

Software risk & drift scoring: a methodology whitepaper is the complete case: the evidence for why severity-first triage fails, the data-source tradeoffs (why we source from OSV ∪ GHSA rather than NVD alone), and — only at the end — the exact published formulas for DriftScore and the DriftRisk™ blend. Open method, proprietary calibration; the PDF is one click away, no form.

Read it, challenge it, and tell us where we're wrong.