How do I tell the difference between a theoretical vulnerability and a weaponised exploit?

A theoretical vulnerability is a disclosed security flaw that may have limited practical exploitation potential, while a weaponised exploit has been actively operationalised by attackers using exploit kits, malware, ransomware campaigns, or automated attack tooling. Vulnerabilities with public proof-of-concept exploits, KEV inclusion, or observed attack activity typically require higher remediation priority.

What role does threat intelligence play in predictive vulnerability scoring?

Threat intelligence improves predictive vulnerability scoring by analysing exploit activity, attacker behaviour, ransomware campaigns, proof-of-concept releases, asset exposure, and real-world targeting trends. This helps organisations prioritise vulnerabilities based on actual exploitation likelihood rather than relying solely on static severity ratings such as CVSS.

What is exploit prediction scoring (EPSS) and how does it compare to CVSS?

EPSS (Exploit Prediction Scoring System) estimates the likelihood that a vulnerability will be exploited in the wild, while CVSS measures technical severity and potential impact. Unlike CVSS, EPSS focuses on real-world exploitation probability using threat intelligence and historical exploit data, making it highly valuable for vulnerability prioritisation and operational risk management.

Vulnerability Intelligence & Exploit Analysis

Cybersecurity SOC dashboard comparing CVSS vulnerability severity with EPSS and CISA KEV exploitation signals, highlighting flawed vulnerability prioritisation models

Featured

Vulnerability Backlog: Why CVSS Prioritisation Is Broken and How to Fix It | Hackerstorm

Hackerstorm Threat Intelligence Vulnerabililty Intelligence 05 June 2026

Executive TL;DR:

» The NVD's April 2026 triage shift means automated asset matching using CPE identifiers is now working from an incomplete dataset.

» Standard CVSS models force teams to patch 57% of all vulnerabilities, yet only catch 2.3% of real-world exploitation attempts.

» Chaining EPSS + KEV + asset reachability drops enterprise vulnerability workloads by 95% while keeping 85%+ threat coverage.

Reading time 15 minutes

AI development speed outpacing security controls visualised as a production gap

Vibe Coding Security: Threat Model, Guardrails & Production Risk | Hackerstorm

Hackerstorm Threat Intelligence Vulnerabililty Intelligence 18 April 2026

AI-assisted development is accelerating faster than security teams can keep up. The Purple Book Community 2026 survey of 650+ security leaders shows 73% report velocity exceeding review capacity, with 70% identifying AI-generated vulnerabilities in production. This analysis examines the resulting “production gap” and its implications.

Enterprise identity security and authentication monitoring concept showing SaaS access, MFA workflows, OAuth security, and cloud identity defense.

Featured

Identity as Initial Access: Credential Theft, Ransomware & Detection | Hackerstorm

Hackerstorm Threat Intelligence Vulnerabililty Intelligence 27 May 2026

Executive TL;DR:

» The Verizon 2026 DBIR confirms software exploitation is surging, but identity compromise remains the primary foothold for ransomware affiliates and SaaS intrusion campaigns.

» Adversaries are bypassing conventional MFA using Adversary-in-the-Middle (AiTM) phishing frameworks, session token hijacking, and targeted helpdesk social engineering.

» Defenders must shift focus from static malware signatures to behavioral alerts, monitoring ignored telemetry like OAuth permission changes and helpdesk ticket anomalies.

Reading time 15 minutes

Diagram illustrating CVSS severity scoring compared with EPSS exploit probability in vulnerability prioritisation workflows

CVSS vs EPSS: How to Prioritise Vulnerabilities by Real Exploitation Risk | Hackerstorm

Hackerstorm Threat Intelligence Vulnerabililty Intelligence 13 April 2026

CVSS assigns severity scores based on theoretical impact. EPSS estimates the probability that adversaries will exploit a vulnerability in the next 30 days. For security teams managing more than 40,000 published CVEs annually, that distinction is operationally critical: Learn why severity alone no longer provides sufficient prioritisation accuracy.

Vulnerability Backlog: Why CVSS Prioritisation Is Broken and How to Fix It | Hackerstorm

Vibe Coding Security: Threat Model, Guardrails & Production Risk | Hackerstorm

Identity as Initial Access: Credential Theft, Ransomware & Detection | Hackerstorm

CVSS vs EPSS: How to Prioritise Vulnerabilities by Real Exploitation Risk | Hackerstorm

FAQs

Vulnerability Backlog: Why CVSS Prioritisation Is Broken and How to Fix It | Hackerstorm

Identity as Initial Access: Credential Theft, Ransomware & Detection | Hackerstorm

Vibe Coding Security: Threat Model, Guardrails & Production Risk | Hackerstorm

Our Mission

Quick Links

Subscribe to our newsletter