Keep the signals separate
CVSS describes technical severity. EPSS estimates exploitation probability. CISA KEV records vulnerabilities known to be exploited. Public exploit tooling provides another form of evidence. QFinch displays these inputs separately and calculates its versioned exploit-risk signal from them.
Use asset context after evidence
Internet exposure, privilege, environment, and data sensitivity belong to the affected asset—not to the global vulnerability record. Apply that context after identifying the canonical vulnerability and confirming affected versions.
Preserve provenance
Every material claim should lead back to a source. A useful prioritization workflow makes the evidence inspectable, reports when it was refreshed, and does not depend on an LLM at page-render time.