ConsultationNot all CVEs are equal. Prioritize by exploitability, external exposure, and data sensitivity. The CISA KEV catalog is a solid starting point for “this week” work.
At Hoxy we recommend a three-step discover-decide-stabilize flow under a weekly SLA. Discovery means accurate software and dependency inventory; without SBOM or inventory, decisions are blind.
Decision stage: is the asset internet-facing? Is there a public exploit? Do compensating controls such as WAF or segmentation buy time? Those answers set patch order.
Stabilize means patching, controlled reboot, service validation, and exceptions with expiry dates. Endless exceptions are simply security debt.
For proprietary products or OT systems that are hard to patch, compensating plans and change windows should be pre-approved by change control so you are not stuck on incident day.
Useful metrics: percent of critical CVEs closed in 7 days, mean age of open findings, and count of ownerless assets. Those numbers are clearer for management than raw CVSS.