A convergence model for weighting exploitation signals

BOD 26-04 landed on June 10, 2026, and it is the loudest official statement so far that a CVE score by itself is not enough to route a queue. The directive requires federal civilian agencies to route vulnerabilities by four variables at once (is the asset publicly exposed, is the CVE on CISA KEV, can the exploit be automated end to end, and does successful exploitation give the attacker total control), and it makes the clock three days plus a forensic triage when all four line up. The federal government just codified what practitioners have argued for years: single signals over-fire or under-fire, and only convergence across signals tells the truth.

Our context-over-CVSS piece in June argued why a 9.8 is not a 9.8 on your network. This post is the how that pairs with it: what are the signal classes, how do you weight them, and what do you do when they disagree.

Prior art we are borrowing from

The public exploitation-intel toolbox is better than most triage teams actually use. EPSS v4 (FIRST and Empirical Security, March 17, 2025) is a daily probability of exploitation in the next 30 days, and it was the first version to score CVEs still sitting in the NVD backlog without a CVSS number. SSVC from CMU SEI and CERT/CC is the cleanest published methodology for turning qualitative variables into decisions instead of a scalar; CISA is one adopter, not the author. CISA Vulnrichment adds ADP decision points (Exploitation, Automatable, Technical Impact) directly to CVE records. VulnCheck maintains a public exploit-maturity taxonomy and a KEV that lists CVEs about 27 days ahead of the CISA catalog on average, across roughly 2,500 entries. CVSS v4 added one Threat metric, Exploit Maturity (Attacked, PoC, Unreported), which only pulls the base score down; v4 adoption is thin and NVD has not retro-scored history, so v3.1 still dominates the data you actually see. The recent chaining paper showed an 18x efficiency gain at 85.6% coverage by combining KEV, EPSS, and CVSS in sequence, though it explicitly excludes asset context. Vendor RBVM scores (Tenable VPR, Qualys TruRisk, Rapid7) fuse similar inputs with proprietary weights, which makes cross-vendor comparison guesswork.

We are not inventing any of the above. What is genuinely open is smaller: no transparent public scheme fuses EPSS, KEV, CVSS v4 Exploit Maturity, SSVC points, and asset context end to end; no published rule handles the case where those signals disagree (an arXiv piece nicknamed "Conflicting Scores, Confusing Signals" documented EPSS-low-but-KEV-listed CVEs and left the question open); nobody has turned BOD 26-04's four qualitative variables into a continuous score outside the federal three-day deadline; and CVSS v4's Exploit Maturity has no canonical public feed at scale. The convergence model below answers the first two on the shoulders of everything above, and the last two are named as work still to do.

The convergence principle

One weak signal should rarely create panic. Two or more independent signals from different classes, each pointing the same way, should move the queue fast.

That is the whole rule, and every choice that follows serves it: group signals into classes so nothing double counts, weight the classes rather than the individual feeds inside them, and require agreement across classes before a case escalates. When your queue is six thousand open findings and every one has three scores attached to it, the scarce resource is not signal volume; it is agreement across independent signals, and everything below is a way to compute that agreement without an argument.

Signal classes

We split exploitation-intel inputs into eight classes. Weight the classes, not the feeds:

1. Confirmed exploitation. CISA KEV, VulnCheck KEV, government advisories with in-the-wild confirmation.
2. Probable exploitation. EPSS v4 probability, honeypot telemetry (Shadowserver, GreyNoise), IR sightings.
3. Exploit availability and maturity. Public PoC, working exploit in Metasploit or Cobalt Strike, ransomware operator adoption; VulnCheck's ladder is the reference.
4. Actor targeting. Named APT or ransomware group referencing the CVE, a botnet family adding a module.
5. Ransomware adoption. The CVE has been observed inside a ransomware kill chain, not just discussed.
6. Vendor urgency. The vendor shipped an out-of-band patch or rated the issue Critical when it usually does not.
7. Local exposure. A vulnerable asset here is reachable from where the exploit lives (internet, tenant, insider) and holds something worth attacking.
8. Defensive coverage. Compensating controls in the exploit path (WAF signature, EDR rule, network segmentation, MFA on the affected route) blunt exploitation end to end.

Classes 1 through 6 are external, world-facing signals; class 7 is your environment; class 8 is your defense. An external-only score cannot honestly converge without 7 and 8 in the model, which is exactly why the chaining paper's headline result was framed as excluding asset context.

Reading each class honestly

KEV. CISA KEV is the strongest single lever available and it is still incomplete: actively exploited CVEs miss the catalog for weeks, and ransomware crews are early adopters KEV does not always catch in time. Treat a listing as a hard escalator and treat silence as unknown, because absence is not safety.

EPSS. EPSS v4 is a solid probability signal for the next 30 days, but it is not an impact signal, it is not a local-relevance signal, and it should never own the queue on its own. Its right role is as one of the classes that must agree before a low-KEV CVE takes floor time from something else.

The exploit maturity ladder. VulnCheck's taxonomy walks from no PoC through unreliable PoC, working PoC, commodity module, active exploitation, and mass exploitation. The operationally meaningful jump is from working PoC to commodity module, because once an exploit becomes a Metasploit or Cobalt Strike primitive the barrier drops from someone has to write it to someone has to run it. Weight the ladder so the commodity step lights up class 3.

Actor targeting only matters through local relevance. A Volt Typhoon campaign against telcos is signal for a telco and background noise for a hospital; multiply targeting through class 7 or leave it out, because scoring by named actor without local relevance is how a program ends up chasing headlines instead of exposure.

Local exposure as the multiplier. External signals rank the world; class 7 ranks your world, and two identical CVEs on a public jump host and on a laptop behind a sleep-locked FDE policy do not converge to the same case no matter how similar their CVSS strings look.

What to do when signals disagree

The interesting case is not agreement. It is a CVE that CISA KEV lists at high urgency while EPSS still reports a low probability, or a CVE with a working PoC and a CVSS 9.8 that has never been seen in the wild. The convergence principle handles disagreement by refusing to let any one class overrule the model, so a KEV listing on its own is a request to escalate, not a mandate to remediate at the top of the queue. The rule we run is:

1. If two or more classes from {confirmed exploitation, probable exploitation, exploit availability, actor targeting, ransomware adoption, vendor urgency} agree and class 7 confirms local exposure, the case goes to the top of the queue.
2. If exactly one class from that set fires and class 7 confirms local exposure, the case escalates to a second tier and opens an investigation; every KEV-listed CVE with no supporting signal earns a human read that decides whether it is an early warning or a KEV false positive for your environment.
3. If class 8 shows the exploit path is blunted end to end, the case moves to a review queue rather than a remediation queue, and the compensating control gets an expiration date so it does not silently rot.

This does not eliminate disagreement; it converts disagreement from an argument between analysts into a routing decision that leaves an audit trail.

A worked example

Take a fresh CVE in an internet-facing appliance you run. No IDs, real shape.

Hour one. NVD publishes with a CVSS v3 base of 9.1, EPSS v4 opens at a modest 0.06, and a working PoC is already up on GitHub, which lights up class 3 alone. A single class with no supporting agreement lands the case in the review queue with a one-line note and no local escalation yet.

Day two. VulnCheck lists the CVE, an IR firm reports one exploited environment, and a ransomware affiliate begins scanning the internet for the affected version banner, so classes 1, 2, 4, and 5 all fire within hours of each other and class 7 confirms an exposed appliance. The case rewrites the top of the queue past several stalled 9.8s that never left round one, because agreement across four independent classes and confirmed local exposure outranks a lonely high base score every time.

Day five. CISA KEV finally lists it and the vendor ships an out-of-band fix, so class 6 confirms and six classes are now in agreement. EPSS may still sit at 0.2, and the queue does not care, because six independent classes outweigh one lagging probability estimate and the routing was defensible from the start.

Mapping BOD 26-04 into this model

The federal directive's four variables map onto four of our classes: asset exposure is class 7, KEV status is class 1, exploit automatability is a specific reading of classes 3 and 6 (commodity availability plus vendor confirmation of ease), and technical impact is what the CVSS v4 base score already reports. BOD 26-04 gives you a coarse urgent-or-not verdict on those variables; the convergence rule gives you a continuous ordering across the rest of the queue once the urgent bucket has been drained. If you run federal infrastructure, use the directive verbatim above the convergence rule; if you do not, use the convergence rule end to end and treat BOD 26-04 as the strongest external validation so far of where the field is heading.

What we still do not have

This is a synthesis on top of prior art, not a finished product. Three gaps remain: a canonical public feed for CVSS v4 Exploit Maturity so E can be populated at scale without vendor-by-vendor scraping; an open translation of BOD 26-04's variables into a continuous score usable outside the federal three-day deadline; and a publication standard for RBVM weights so Tenable VPR, Qualys TruRisk, and Rapid7 InsightVM can be compared without reverse engineering. If your team ships any of these, tell us and we will cite you next time.

CVEasy AI runs this convergence model locally against your inventory inside TRIS™, our twelve-layer prioritization engine, and the queue you see is the agreement across classes rather than any one feed shouting loudest. TRIS keeps its weights transparent to you and the data on your hardware, which is the point of a local-first CTEM platform.