Vulnerability prioritization training with KEV, EPSS and CVSS: Vulnerability Intelligence

Intermediate

Learn vulnerability intelligence: read CVE records, vendor advisories, CISA KEV, EPSS and CVSS as evidence, and decide which vulnerability to fix first on your own estate. You judge exploitation claims, check whether an advisory really applies, apply an SSVC decision model and BOD 26-04 deadlines, and track a fix through to verified closure. Built for CTI and SOC analysts who support vulnerability management, with a free first section.

  • By CTI Academy Team
  • 31 steps
  • 6 sections
  • ~11 hours
  • Certificate
Start the free modulesView curriculum

The first 2 modules are free. Premium unlocks the rest of the path and the certificate.

Vulnerability Intelligence badge

Course at a glance

Format
Online, self-paced
Price
First 2 modules free
Duration
About 11 hours
Level
Intermediate
Content
11 modules, 5 exercises
Certificate
Certificate of completion

Curriculum

31 steps across 6 sections. Sections unlock in order as you complete them.

  1. Reading the RecordModule
  2. Does It Apply Here?Module
  3. The Morning AlertExercise
10 more steps behind a free account
Free account

Ready to start Vulnerability Intelligence?

Create a free account to open the remaining 10 steps and track every step you finish. The first 2 modules are free. Premium unlocks the rest of the path and the certificate.

  • First 2 modules free
  • Progress saved on every step
  • Certificate with Premium
Sign up with email

About this path

A new CVE lands every few minutes, and most of them will never matter to you. The job of a vulnerability intelligence desk is to find the few that do, prove it with evidence, and turn that proof into a fix someone owns. A CVSS 9.8 is a number with a scorer and a version, a KEV entry is a confirmation with a remediation, an EPSS value is a forecast for the next thirty days, and none of them tells you whether your own server is affected.

This path is built on real records. You read the CVE record and NVD page for PHP2Shell (CVE-2026-109618), vendor advisories from PHP, Palo Alto Networks and Ivanti, the CISA Known Exploited Vulnerabilities catalogue with its new forensic triage flag, FIRST's EPSS scores and daily files, the CERT/CC SSVC decision tables and CISA's Binding Operational Directive 26-04. Every value is shown with the date it was read, because dates are part of the evidence.

The first section is free. It takes you from an alert to a first call: reading a CVE record and an advisory, then deciding whether it applies to a given asset, including the backported package whose banner still looks vulnerable. Later sections cover exploitation evidence and the clocks that separate disclosure from exploitation, CVSS vectors and EPSS forecasts and what to do when they disagree, exposure and dependencies on your own estate, SSVC and BOD 26-04 deadlines, why a patched system is not a clean one, and how to run and close a remediation queue.

You work for Oakline Mutual, a fictional insurer, and keep its decision ledger from the first lesson to the last. Missions put you on its desk: sorting a morning alert, judging exploitation claims before a deadline, giving the same CVE different decisions on different assets, investigating a PHP2Shell incident the patch did not close, and building the remediation board that ends the path.

You should know the basics of threat intelligence first. If PIRs, source grading and ATT&CK are new to you, start with the Cyber Threat Intelligence path.

What you will learn

  • Read a CVE record and an advisory as evidence. Tell who wrote each part of a CVE record, which advisory facts change your action, and which can change after you read them.

  • Decide whether a vulnerability applies. Match versions, branches, configuration and vendor backports to a real asset, and keep 'needs verification' honest.

  • Judge exploitation claims. Separate a public PoC, a report, a confirmation and a local compromise, and keep disclosure, observation and catalogue dates apart.

  • Use KEV, CVSS and EPSS correctly. Read each signal with its scorer, version and date, and decide what to do when they point different ways.

  • Make a local decision with SSVC. Combine exposure, dependencies, criticality and controls in a CERT/CC SSVC deployer model, and borrow BOD 26-04 deadlines sensibly.

  • Look beyond the patch. Know when a fixed system still needs forensic triage, and when missing telemetry leaves a host unresolved.

  • Run the remediation queue. Turn priorities into owned actions with deadlines, revise them when advisories change, and close only on evidence.

Who this path is for

  • CTI analysts who support vulnerability management and want to send more than CVE lists.

  • SOC analysts moving toward threat intelligence or vulnerability work.

  • Vulnerability management analysts who want to prioritise on exploitation evidence, not scores alone.

Frequently asked questions

Vulnerability intelligence is the evidence work behind a patching decision: what a CVE affects, whether it is being exploited, how exposed your own systems are, and how fast it must be fixed. It turns CVE records, vendor advisories, CISA KEV, EPSS and CVSS into a decision someone owns.

Vulnerability management courses usually teach scanners and patch cycles. This path teaches the intelligence layer that feeds them: judging exploitation evidence, checking whether an advisory really applies, and using KEV, EPSS, CVSS and SSVC to decide which fix comes first.

No. You should know what a CVE and a patch are and have the basics of threat intelligence. Every vulnerability intelligence term is explained when it first appears.

No. The path is defensive. Exploits appear only as evidence a defender reads: whether code exists, who claims what, and whether a vendor or CISA confirmed exploitation.

Real records: CVE JSON records, NVD pages, vendor advisories, the CISA KEV catalogue, FIRST EPSS scores, CERT/CC SSVC tables and CISA BOD 26-04, each with the date it was read.

Yes. Section 1, from reading a CVE record to deciding whether it applies, and its mission are free.

Five hands-on cases on Oakline Mutual's desk, graded on exact answers you read from the evidence: asset IDs, versions, dates, counts and decisions.

The directive binds US federal agencies, but its tiers are a clear model for risk-based deadlines. The path shows what it requires and what a private organisation can sensibly borrow.

Yes. Completing the lessons and missions earns a verifiable certificate you can add to LinkedIn.