Patch the few that matter — and prove you were right to defer the rest
How I use the Decisions view: a cut-line that splits my stack into ACT and DEFER, and a timestamped ledger that makes 'we chose to wait' an argument instead of a shrug.
Nobody patches every CVE. That's not a confession, it's arithmetic. The real skill in vulnerability management isn't clearing the ACT pile — it's being able to stand behind the DEFER pile when someone asks, six months later, why that one was left open. So the feature I lean on hardest in My Stack isn't the feed. It's Decisions — the part that turns 'we chose to wait' from a shrug into an argument.
This is a walkthrough of how I actually run it: the cut-line that does the sorting, the ledger that keeps the receipts, and the auto-escalation that catches the deferral I got wrong.
The cut-line: one rule that does the sorting
A cut-line policy is a single, explicit rule for what counts as act now. Mine is: act on CISA KEV, or a public exploit, or EPSS ≥ 50%. Everything matched to my stack gets measured against it and dropped into ACT or DEFER. Note what's not in there: raw CVSS. A 9.8 that nobody is exploiting does not force ACT; it ranks within the pile, it doesn't create it. That's the whole SSVC idea in one line — filter by exploitation first, let severity order what's left.
| Axis | What it means | Role in the cut-line |
|---|---|---|
| CISA KEV | Confirmed exploited in the wild (a fact) | Forces ACT |
| Public exploit | Working exploit code exists | Forces ACT |
| EPSS ≥ 50% | Modelled probability of near-term exploitation | Forces ACT |
| CVSS | Potential severity if exploited | Ranks within ACT — never creates it |
The ledger: why the DEFER pile is the point
Here's the part most triage tools skip. When I mark a CVE ACT, DEFER, or resolved, the decision freezes the policy and the risk snapshot at that instant — the CVSS, the EPSS, the KEV status, the exact cut-line I was using — into an append-only ledger. If I defer something because EPSS was 3% and it wasn't on KEV, that reasoning is preserved verbatim. Later, when the picture changes, the old decision isn't quietly overwritten; it's superseded, and both versions stay in the trail.
That's what makes a deferral defensible. 'We didn't patch it' is a liability. 'On this date, under this policy, it wasn't on KEV, had no public exploit, and modelled at 3% — here's the frozen snapshot' is an audit answer. The whole thing exports to CSV (cve, decision, source, in_kev, has_exploit, epss, cvss, reason, decided_by, decided_at) so it drops straight into a report or a ticket.
Auto-escalation: the deferral I got wrong
The dangerous deferral is the one that was right when I made it and rotted. An hourly monitor re-checks everything I deferred against my live cut-line. The moment a deferred CVE crosses the line — a KEV entry lands, a public exploit drops — it's auto-escalated to a system decision that supersedes my defer, and it shows up flagged. I don't have to remember to re-triage; the ledger proves the deferral was monitored, not forgotten. Citrix Bleed (CVE-2023-4966) is the textbook case: fine to watch on day one, absolutely not fine the day the exploitation tag flipped.
The blind-spot flag
One more number on that page earns its place: blind spots — CVEs that clear my cut-line (I should act) but have no scanner check available, so a scan-only workflow would never surface them. On my stack that was 4. Those four are the argument for a watch layer existing at all: they're precisely the things your scanner can't tell you about.
Where it's honest about its limits
- A 'resolved' mark is self-asserted. Recording that you fixed something is not proof you fixed it — there's no scan behind that claim unless you run one. The ledger records your call, not ground truth.
- Vendor-level watches inflate the ACT count. If your stack is vendor names, the ACT pile is big. Import versions and it collapses to a real queue (see the import walkthrough).
- The policy is only as good as you set it. A weak cut-line (say, KEV-only) will happily let exploited-but-not-yet-KEV bugs sit in DEFER. The tool shows you when your policy is weaker than the shipped default; it won't stop you.