Severity is an adjective. Priority is a verb.

On June 10, 2026, CISA issued Binding Operational Directive 26-04 and quietly ended a twenty-year habit. Federal agencies are no longer told to patch by severity. They are told to patch by decision tier: three days for vulnerabilities that are exploited, exposed, and automatable; fourteen days for the next tier; sixty for the one after; and deferral to the next upgrade cycle when no risk criterion is met. Nowhere in that logic does a CVSS adjective drive the clock.

I have spent years in enterprise vulnerability management watching teams burn entire patch cycles on CRITICAL findings that no attacker will ever touch, while a MEDIUM with a public proof of concept and an internet-facing asset sits in the backlog. The problem was never the scanners. The problem is the vocabulary. Critical, High, Medium, Low. Four adjectives that describe a vulnerability in a vacuum and tell you nothing about what to do before lunch.

So when we built the scoring layer in CVEasy, we made a deliberate nomenclature choice. Every exposure lands in one of four bands, and every band is a verb: ACT, ATTEND, TRACK, MONITOR. This post explains the proposal, the thresholds behind it, and why I think this is where the whole industry is headed.

The proposed bands

CVEasy's TRIS 12 Layer Scoring engine produces a 0 to 100 score for every exposure. The score matters for ranking. The band matters for action. Each band carries a service level window, and the window is the point: a band is a commitment, not a color.

Band	TRIS score	The commitment	What it means
ACT	85 to 95	Patch within 24 to 72 hours	Active threat or near-certain exploitation. Coordinated response now. Wake people up if the asset warrants it.
ATTEND	65 to 84	Patch within 2 weeks	Significant exploitation risk. Needs supervisory attention and a named owner this sprint, not a ticket in a queue.
TRACK	45 to 64	Patch this quarter	Moderate risk. Plan the remediation into normal change windows. Reassess if the signals move.
MONITOR	0 to 44	Accept and watch	Low exploitation probability today. Fold into the next release cycle or accept the risk. Automatic reassessment if EPSS climbs or the CVE lands on KEV.

Two design decisions deserve a defense.

First, the ceiling is 95, not 100. TRIS normalizes 134 raw points across twelve layers with diminishing returns, and a perfect score would require extreme signals on every layer at once. A scoring system that regularly hands out its maximum value has no headroom left when something genuinely worse arrives. Ask anyone who lived through a year with four CVSS 10.0s.

Second, the bands are asymmetric on purpose. ACT is a ten-point window at the top. MONITOR swallows the entire bottom 45 points. That mirrors reality: research behind EPSS consistently shows that only a small fraction of published CVEs are ever exploited in the wild. Most of the vulnerability universe deserves exactly one action, which is watching. A prioritization scheme that cannot say "do nothing yet" out loud will never earn trust for the moments it says "move now."

You have seen these verbs before. That is the point.

ACT, ATTEND, and TRACK are not words we invented. They are the decision outcomes of the Stakeholder-Specific Vulnerability Categorization framework, SSVC, developed at Carnegie Mellon's SEI and adopted by CISA in November 2022. SSVC walks a decision tree over exploitation status, automatability, technical impact, and mission prevalence, and instead of emitting a number it emits a decision: Track, Track*, Attend, or Act.

That was the philosophical break. CVSS asks "how bad is this vulnerability, intrinsically?" SSVC asks "what should this specific organization do about it, now?" One is an adjective. The other is a verb with a deadline attached.

We aligned CVEasy's vocabulary to SSVC deliberately. When a CISO who has read CISA's guidance sees an ACT band in a CVEasy report, no translation layer is needed. The difference is mechanical: SSVC is a decision tree a human walks per vulnerability, which is honest but does not scale to a backlog of forty thousand findings. TRIS computes the equivalent decision continuously, across twelve layers of live signal, and the band falls out of the math.

The receipts: the industry is moving to decision language

This is not a prediction. The migration is observable, and it accelerated hard over the last twenty-four months.

CISA Vulnrichment, 2024. When the NVD enrichment backlog blew up in early 2024, CISA's answer was not more CVSS scores. It was Vulnrichment, a program that stamps SSVC decision points directly onto CVE records. The United States government now publishes vulnerability guidance as decisions, not severities. Coverage is still partial, roughly 46 percent of CVEs by VulnCheck's count, which is exactly why continuous computed scoring has to fill the gap. But the direction of travel is unambiguous.

CVSS v4.0's own fine print, 2023. FIRST, the organization that maintains CVSS, spent much of the v4.0 rollout saying the quiet part loudly: CVSS is a severity measure, not a risk measure, and the base score alone should not drive prioritization. When the framework's own stewards tell you the number needs context before it becomes a decision, believe them. We wrote the longer autopsy in why CVSS-only prioritization is dead.

BOD 26-04, June 2026. The directive I opened with. Federal remediation clocks are now set by decision criteria, and the criteria are pure SSVC DNA: KEV status, public exposure, exploit automatability, degree of control. Agencies must be operating on these timelines by December 7, 2026. Analysts are already calling it the end of patch-everything, and every FedRAMP cloud provider and federal contractor inherits the pressure downstream.

The vendor scoreboard. Tenable has VPR. Qualys has TruRisk. Rapid7 has Active Risk. Credit where due: all three correctly concluded that raw CVSS fails as a prioritization input, and each blends threat intelligence into a better number. But they all stop at the number. A VPR of 8.9 still makes the analyst do the last, hardest step: deciding what 8.9 obligates anyone to do, and by when. The band is that last step, done for you, with an SLA attached.

The industry spent two decades refining the adjective. The last mile was always the verb.

How TRIS produces the band

A band is only as good as the evidence under it, so here is the layer walk. TRIS 12 Layer Scoring feeds each band decision from twelve signals. Seven are foundational, layers other scoring systems attempt: CVSS as a severity foundation, deliberately weighted down to 8 percent of the model; EPSS exploitation probability; confirmed exploitation via CISA KEV; business impact context; network exposure topology; threat pressure, meaning attacker readiness and tooling; and temporal dynamics as the exposure ages.

Five layers are novel, and nobody else combines them: attack path blast radius, what an attacker reaches after this host; supply chain dependency propagation, the Log4Shell lesson encoded as math; a defense efficacy coefficient, whether your existing controls already blunt the exploit path; predictive threat trajectory, where this CVE's signals are heading rather than where they sit; and financial impact quantification.

Stack those twelve and the band stops being a re-badged severity label. A CVSS 9.8 on an isolated lab box with no exploit activity, full compensating controls, and a flat trajectory scores into MONITOR, and the model can show you exactly why. A CVSS 6.5 that is on KEV, internet-facing, wormable through a shared dependency, and trending upward in exploit chatter lands in ACT. One number lies. Twelve layers tell the truth. Five of them nobody else has.

What this changes on a Tuesday

Nomenclature sounds cosmetic until you watch it move a meeting. Three concrete shifts I have seen when a team switches from severities to action bands:

• SLA arguments end. "Critical" invites negotiation because it describes the vuln, not the obligation. "ACT, 24 to 72 hours" is the obligation. The debate moves to whether the scoring inputs are right, which is a debate worth having. If you are still writing severity-keyed SLAs, start with our guide to vulnerability SLAs.
• Reporting gets honest. A board slide that says "3 ACT, 5 ATTEND, 2 TRACK, 1 MONITOR" communicates workload and urgency in one line. A slide that says "1,847 highs" communicates nothing except that nobody is going to fix 1,847 of anything.
• Risk acceptance becomes a first-class outcome. MONITOR is a decision, recorded and revisited automatically when EPSS moves or KEV lands. That is materially different from a LOW that scrolls off page forty of a PDF and is never seen again.

How CVEasy AI surfaces this

Every exposure CVEasy ingests, whether from a connector like Rapid7 or a scan import, is scored through the TRIS 12 layer engine and banded on the spot. The Command Center leads with the band distribution, not a severity pie chart. Enterprise scoring contextualizes the band against your actual asset inventory and business profile, so the same CVE can sit in ACT for your payment gateway and TRACK for the dev enclave, which is exactly what SSVC's stakeholder-specific premise demands; the same CVE, different risk piece walks that rubric in detail. Customer deliverables carry the band tally on the first page, and BASzy goes one step further: when it confirms exploitability in your environment, the finding is marked CONFIRMED EXPLOITABLE, which is the strongest ACT justification that exists. Everything runs local. Your findings never leave your machine to get scored.

Score any CVE against the twelve layers free, no signup, in the TRIS Lab. Run your scariest critical and your most ignored medium. See which one actually deserves your weekend.