Prioritization
A cluster scan returns thousands of findings. Most are not worth acting on this week: the package isn't deployed, there's no fix, or nobody is exploiting it. Ephor ranks findings so the ones that matter rise to the top instead of being buried in a list sorted by severity.
The three signals
A finding's priority is built from three signals Ephor already knows:
| Signal | How Ephor knows it |
|---|---|
| Deployed | At least one instance of the finding is present in the latest scan (status open or triaged). The scanner runs in-cluster, so it sees what is actually running. |
| Exploitable | The CVE is on the CISA KEV catalog, or its EPSS score is at or above the configured threshold. |
| Fixable | A fixed version is available for the affected package. |
Deployed and fixable come from the scan and the advisory data. Exploitable comes from the enrichment feeds.
Priority tiers
Findings fall into one of four tiers. The tiers are evaluated in order, so each finding lands in the first one it matches:
| Tier | Meaning | Rule |
|---|---|---|
| P0 — Act now | Deployed, fixable, and known to be exploited in the wild | Deployed and on KEV and fixable |
| P1 — Urgent | Deployed, fixable, and likely exploitable | Deployed and exploitable and fixable |
| P2 — Plan | Deployed and exploitable, but no fix yet | Deployed and exploitable, no fixed version |
| P3 — Monitor | Everything else | Not deployed, or not exploitable |
Within a tier, findings are ordered by EPSS score, then by CVSS score.
Priority is computed at query time, never stored. "Deployed" changes with every scan, so a stored tier would go stale; only the enrichment inputs (KEV and EPSS) are persisted.
What "exploitable" means here
KEV and EPSS describe exploitation in the wild — whether a CVE is being or is likely to be exploited somewhere, by anyone. They do not tell you whether the vulnerable code path is actually reachable in your specific deployment.
Ephor is deliberate about this claim. It knows a vulnerable package is deployed and running in your cluster, because its scanner sees the workloads and images. It does not claim code-level reachability — whether the vulnerable function is loaded or executed — which requires runtime instrumentation Ephor does not do. "Deployed and exploitable" means the package is running and the CVE is exploited in the wild, not that an exploit path has been proven in your environment.
Tuning the threshold
A CVE counts as exploitable if it is on KEV, or if its EPSS score is at or above EPHOR_ENRICHMENT_EPSS_THRESHOLD (default 0.10). KEV always counts, regardless of EPSS.
Lower the threshold to pull more findings into the exploitable set (more P1/P2); raise it to keep the worklist tighter. KEV listing is unaffected either way. See Configuration.
Where it shows up
- Dashboard — the worklist hero shows how many findings need action now (P0 + P1), and the namespace heatmap can be viewed by priority tier.
- Vulnerabilities — the list is sorted by priority by default and can be filtered to KEV-only, deployed-only, fixable-only, or a minimum EPSS score. See the API reference.
- Triage — the same filters are available when preparing a triage session, so review starts from the findings that matter.