Fix the Right 1%: KEV-First Vulnerability Management for Small Security Teams

Microsoft fixed 1,411 vulnerabilities in October and one was being actively exploited. Here's a 3-tier patching approach that doesn't need a bigger budget.

That's the October 2026 Patch Tuesday, a record. 70 of those flaws were rated critical. If your team works through that list by CVSS score, they'll spend weeks on 70 critical bugs while the one that attackers were actually using waits its turn.

The wider numbers tell the same story. In 2025, 48,162 CVEs were published and 245 were added to CISA's Known Exploited Vulnerabilities (KEV) catalog. That's about 0.5%. Meanwhile, the median time from disclosure to a KEV listing fell to 5 days (Rapid7, 2026).

You don't need a bigger budget for this. You need a different sort order. Here's the KEV-first approach I'd run with a small team:

1. Subscribe to the KEV feed. It's free, in JSON or CSV, and updated as entries are added. Match it daily against your asset inventory.
2. Use three patching tiers instead of one queue: • Tier 0: KEV-listed and internet-facing, fixed within 72 hours or isolated • Tier 1: KEV-listed and internal, or EPSS in the top band and internet-facing, fixed within 14 days • Tier 2: everything else, in the normal monthly cycle
3. Add EPSS. FIRST's free daily score estimates how likely a CVE is to be exploited soon. Use it to rank the non-KEV backlog.
4. Treat CVSS as a measure of impact. It tells you how bad a bug could be, not how likely it is to be exploited.
5. Report one metric to leadership: the share of KEV-listed vulnerabilities on internet-facing assets fixed within SLA. That number tells the board more than a count of open vulnerabilities.
6. Make exceptions visible. If a Tier 0 item can't be patched, it needs a compensating control, a named owner and an expiry date.

The leadership point: a small team that always fixes the right 1% will beat a big team trying to fix 100%.

How does your team decide what gets patched first?