How The Atlas Score Works.
What gets collected, what decides whether a CVE gets a full analysis, what each score means, and where the data stops. Every number below is the one the scoring uses.
- 01Exploitation EvidenceKEV listings and in-the-wild reports carry the most weight. A listed CVE is patched first, whatever its CVSS.
- 02LikelihoodEPSS estimates the chance of exploitation in the next 30 days. Public exploit code raises it.
- 03ImpactCVSS base score and whether the flaw needs no login or user action.
- 04Who Uses ItRansomware use and named actors move a CVE up. The result is the publication score, from 0 to 100.
The Four Lists.
- Known exploited
- On the CISA Known Exploited Vulnerabilities catalog. A listing publishes a full analysis on its own, whatever the score.
- Emerging threats
- Not on KEV, but an EPSS forecast of 50% or more, or a weaponized exploit.
- Watchlist
- Not on KEV and not emerging, with a publication score between 34 and 69.
- All CVEs
- Every published CVE, so any identifier resolves to its severity, dates and exploitation status.
The curated set is every KEV-listed CVE, every CVE with an EPSS forecast of 20% or more, and the most discussed CVEs of the last 90 days. It is refreshed hourly; EPSS forecasts are refreshed daily.
Why One CVE Gets A Full Analysis And Another Only Scores.
Nine components are added up, 114 points of possible evidence capped at 100. Under 34 a CVE keeps its row with no analysis; from 34 to 69 it is on the Watchlist; at 70 or more, or on KEV, it gets a full analysis page.
| Component | Max points | What it measures |
|---|---|---|
| Exploitation status | 26 | CISA KEV listing first, then a weaponized exploit module, then public proof-of-concept code, then a recent disclosure. |
| Exploit probability | 18 | The EPSS forecast, applied proportionally: a 90% forecast earns almost the whole allowance. |
| Public exploit code | 14 | How many public proof-of-concept links exist, weighted up when a weaponized module is available. |
| Product criticality | 14 | Higher for edge and identity infrastructure (VPN, firewall, gateway, directory) than for a leaf application. |
| Risk | 12 | A blend of the CVSS score, the EPSS forecast, the KEV listing and the existence of exploit code. |
| Advisory activity | 10 | Vendor and government advisories referenced by the record, plus revisions after disclosure. |
| Recency | 8 | Days since publication, in bands of 3, 10 and 30 days. |
| Severity | 6 | Critical or high CVSS. Kept small: severity says what would happen, not whether it does. |
| Attention | 6 | Public discussion volume. Capped low: chatter tracks awareness, not risk. |
Components in red are evidence of exploitation; the rest are context. Product criticality counts edge and identity infrastructure: atlassian confluence, checkpoint, cisco adaptive security appliance, cisco firepower, cisco identity services engine, cisco ios xe, cisco secure firewall, citrix gateway, citrix netscaler, f5 big-ip, fortinet fortigate, fortinet fortimail, fortinet fortimanager, fortinet fortios, fortinet fortiproxy, fortinet fortiweb, ivanti connect secure, ivanti endpoint manager, ivanti policy secure, juniper junos, microsoft active directory, microsoft entra, microsoft exchange server, okta, paloaltonetworks globalprotect, paloaltonetworks pan-os, pulsesecure pulse connect secure, sonicwall, sophos firewall, vmware esxi, vmware vcenter, zyxel.
KEV, EPSS And CVSS Answer Different Questions.
- CISA KEV
- Has this been exploited?
- An observation, the strongest signal here. Absence from the catalog is not proof of safety.
- EPSS
- Will exploitation be seen in the next 30 days?
- A daily forecast over every scored CVE. High and not on KEV is the interesting case.
- CVSS
- How bad would it be if exploited?
- Consequence, not likelihood. An unscored CVE is unscored, not harmless.
- CWE
- What kind of mistake is it?
- The weakness class (path traversal, injection, memory corruption) that groups similar flaws.
- Exploit maturity
- How far has exploitation got?
- None known, then public proof-of-concept code, then a weaponized module, then confirmed exploitation (KEV).
Where The Data Stops.
Whether you are exposed
A CVE page knows the product, not your network. Exposure needs your asset inventory.
Exploitation nobody reported
KEV lists what has evidence behind it. Absence from KEV is not proof of safety.
Exact affected builds
Scope comes from vendor and CNA data. When they disagree, both are shown.
Real-time completeness
Sources sync on their own schedules; each page shows the date of its figures.
ATLAS Shows The World. The Platform Shows Your Share Of It.
Brandefense matches every new exploited CVE against the products discovered on your perimeter and opens a finding with an SLA.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.