In the world of Industrial Control Systems (ICS) and Operational Technology (OT), vulnerability management is fundamentally different from that in traditional IT environments. While IT teams can often patch quickly and absorb downtime, OT environments prioritize the SRP triad (Safety, Reliability, and Performance) above all else. This makes vulnerability prioritization not just a technical decision but an operational one.
This blog examines three key frameworks and scoring systems commonly used to assess and prioritize vulnerabilities. The Known Exploited Vulnerabilities (KEV) catalog, the Common Vulnerability Scoring System (CVSS), and the Exploit Prediction Scoring System (EPSS) each have distinct use cases and benefits. However, many organizations struggle to understand their differences and, more importantly, how to apply them effectively in OT environments. After reading this blog, you will not only have a better understanding of each model but also practical guidance on how to use them together to improve risk-based decision-making in OT.
Understanding the Three Models
Before diving into how to apply these vulnerability ranking models to OT, it’s important to clarify what each framework represents.
KEV: Known Exploited Vulnerabilities
The KEV catalog, maintained by CISA, is a curated list of vulnerabilities that are actively exploited in the wild. Unlike theoretical risks, KEV represents confirmed, real-world threats.
What makes KEV unique is its binary nature:
- A vulnerability is either on the list or not
- If it’s on the list, attackers have been confirmed to have used it in the wild
In OT environments, KEV is especially valuable because it cuts through the noise. If a vulnerability affecting an industrial asset appears in KEV, it should be treated as a high-priority issue regardless of its CVSS score.
CVSS: Common Vulnerability Scoring System
CVSS is the most widely used framework for assessing the severity of vulnerabilities. It provides a numerical score (0–10) based on factors such as:
- Attack complexity
- Required privileges
- Impact on confidentiality, integrity, and availability
While CVSS is useful for standardization, it has limitations when applied to OT environments. It is context-agnostic, meaning it does not consider your environment or any compensating controls that may be present. It also does not account for active exploitation and often overemphasizes theoretical impact.
For example, a vulnerability with a CVSS score of 9.8 may require conditions that are unrealistic in an air-gapped or segmented OT network before it can be used against you.
EPSS: Exploit Prediction Scoring System
EPSS takes a different approach. Rather than measuring severity, it estimates the likelihood that a vulnerability will be exploited in the near future. EPSS provides a probability score (0–1) based on:
- Historical exploit data
- Threat intelligence trends
- Vulnerability characteristics
This makes EPSS particularly useful for prioritization because it introduces a predictive element missing from CVSS.
However, EPSS also has limitations when applied to OT environments. It is largely trained on IT-centric data, so it may not fully reflect OT-specific threat actor behavior.
Why These Differences Matter in OT
In IT environments, vulnerability prioritization often follows a straightforward model: patch vulnerabilities with the highest CVSS scores first. In OT, this approach can be dangerous.
Shutting down a system to patch a “high severity” vulnerability is often not possible, as some systems run for years without downtime. If you, as a cybersecurity professional, enter one of these environments and try to apply a patch that requires system downtime, it would not only disrupt production and possibly impact safety systems, but it can also lead to you losing all credibility with the engineers and operators you are supposed to be working with.
This is where understanding the distinction between KEV, CVSS, and EPSS becomes critical.
- CVSS tells you how bad a vulnerability could be
- EPSS tells you how likely it is to be exploited
- KEV tells you it is already being exploited
In OT, where change is costly and risk tolerance is low, combining these perspectives enables more informed decisions.
A Practical Approach to Using Vulnerability Scoring in OT
Rather than relying on a single metric, leading OT security programs integrate all three into a layered prioritization approach.
The First Step: Use the KEV Catalog
Our clients often start with the KEV catalog. If a vulnerability appears on the KEV, immediate action is required. These vulnerabilities will be treated as urgent priorities, and you should:
- Validate exposure in your OT environment,
- And patch or apply compensating controls
In OT, immediate patching is not always possible. Even if you can’t patch, though, there are still things you can do. Examples of compensating controls include:
- Network segmentation
- Access control tightening
- Monitoring for indicators of compromise
The great thing about these compensating controls is that you may already be doing them. If that is the case, this is a great opportunity to report to your leadership about how you were already defending against the scary new vulnerability they heard about in the news.
Use EPSS to Refine Prioritization
After addressing KEV-listed vulnerabilities, EPSS helps identify which remaining vulnerabilities are most likely to be exploited next.
In practice, it is often better (both easier and faster) to focus on vulnerabilities with high EPSS scores, even if their CVSS score is moderate. For example, a vulnerability with:
- CVSS: 6.5 (moderate)
- EPSS: 0.85 (high likelihood)
may pose a greater real-world risk than a CVSS 9.0 vulnerability with low EPSS.
Contextualize CVSS for OT Impact
CVSS should not be ignored, but it must be interpreted through an OT lens. A critical step in developing a mature OT cybersecurity program is to tailor raw CVSS scores to your OT environment. Consider the following:
- Does the vulnerability affect a safety-critical system?
- Is the asset externally accessible?
- Are there existing compensating controls?
In OT, availability and safety often take precedence over confidentiality. A lower CVSS score on a critical PLC may warrant higher priority than a higher-scoring vulnerability on a non-critical system.
Building an OT-Centric Risk Model
To operationalize these insights, organizations should adopt a risk-based vulnerability management model tailored to OT environments. By combining these factors, organizations can create a prioritization matrix that aligns cybersecurity actions with operational risk tolerance.
Real-World Example
We can apply these concepts to a typical client environment, such as a manufacturing plant, and examine two vulnerabilities.
A traditional, risk-score-centered approach would prioritize Vulnerability A due to its high CVSS score. However, an OT-informed risk-based approach would prioritize Vulnerability B because:
- It is actively exploited (KEV)
- It has a high likelihood of being used in the future (EPSS)
- It still has a significant impact (CVSS)
Vulnerability A was CVE-2023-38408, an OpenSSH vulnerability that allows Remote Code Execution but requires a relatively complex attack path. Vulnerability B was CVE-2023-36846, a flaw in Juniper firewalls. Despite its lower CVSS score, it likely represents a higher risk impact due to the importance of security at the edge of OT networks.
Key Takeaways for OT Leaders
Understanding KEV, CVSS, and EPSS is not just about metrics. It’s about making better decisions amid operational constraints.
The most effective OT security programs:
- Treat KEV as a trigger for immediate risk evaluation
- Use EPSS to anticipate emerging threats
- Interpret CVSS within the context of OT operations
- Always align decisions with the SRP triad
By doing so, organizations can reduce cyber risk without compromising safety or uptime.
In OT environments, vulnerability management is a puzzle each organization must solve. KEV, CVSS, and EPSS each provide a piece of the puzzle. When used together and contextualized for OT, they enable a smarter, more resilient approach to cybersecurity. If your organization is looking to refine its OT vulnerability management strategy or better integrate KEV, CVSS, and EPSS into operational workflows, Enaxy can help. Reach out to info@enaxy.com to start the conversation.