Sorting by severity ranks your backlog for somebody else. CVSS is scored once, by someone who has never seen your deployment. Sort a backlog by it and a malicious package with a KEV listing lands underneath a wall of vendor sevens that nobody has ever attacked. A strategy replaces that with an ordered list of rules, stored against your organisation and applied to every finding as it lands: 15 signals to choose from, 23 rules in the shipped default, and the first matching rule decides the tier.
The signals you can rank
A rule is only worth dragging if the data behind it exists for every finding, every day. These are the signals available to a strategy today, with examples of the feeds that supply them.
Known malware
OpenSSF Malicious Packages (OSV MAL), OpenSourceMalware, Vulnetix Malscan, VDB malware advisories
The dependency itself is hostile rather than merely vulnerable. The system default ranks this above everything else.
CISA, ENISA EU, Vulnetix and VulnCheck KEV
CISA KEV, ENISA EU KEV, Vulnetix KEV, VulnCheck KEV
Four catalogues, four separate rules, so you decide whether an ENISA EU listing carries the weight of a CISA one.
Weaponized exploit
Metasploit modules, Nuclei templates, Snort rules, Nmap NSE scripts
Someone has packaged the vulnerability into a tool that runs. No research phase required, just a target list.
Active exploitation (sightings)
CrowdSec honeypots, Shadowserver Foundation, CIRCL and MISP sightings
Attack traffic observed against real sensors, with a first-seen date kept on the signal.
PoC exploit
Exploit-DB, VulnCheck XDB, GitHub PoCs, 0day.today, HackerOne and Bugcrowd disclosures, Project Zero 0day in the wild
Public proof the vulnerability is reachable in practice.
EPSS and Coalition ESS
EPSS (FIRST), Coalition ESS
Two models answering two different questions. EPSS asks whether an exploit will surface publicly in the next 30 days; Coalition ESS asks whether attackers are using it now. Separate rules, so you decide which worries you more.
CVSS, CWSS, and your own scores
NVD and CNA CVSS, CWSS, Custom CVSS, Custom CWSS
CVSS rates the vulnerability and arrives the same for everyone; CWSS rates the underlying weakness and is built to be tailored to your environment. Both measure impact, so Vulnetix ranks on the higher of the two. Custom CVSS and Custom CWSS are those scales re-scored by your analysts, on their own rules, so you decide whether your scoring outranks the vendor number.
All remaining
Ordered oldest first
Everything the rules above did not match. Exactly one of these, always pinned at the bottom.
Those feeds are samples, not the list
Naming a handful of sources per rule keeps the explanation readable. The real inputs run much wider. The Vulnetix VDB is the largest global collection of vulnerability and patch data: 160+ upstream authorities aggregated, normalised and cross-referenced. Vulnerabilities from CVE, GHSA, OSV, PYSEC, RUSTSEC, GCVE, national CERTs and vendor PSIRTs. Exploits graded by maturity from a public PoC to a packaged module to a live honeypot sighting. Patch reality in each vendor dialect, from Microsoft Patch Tuesday to Red Hat RHSA to Canonical USN, with CSAF and VEX wherever upstream publishes it. Malicious package advisories and live indicators across ten ecosystems. End-of-life cycles for runtimes, frameworks, distributions and base images.
How a strategy works
Clone the read-only system default, drag the rules into your order, and save. Priority is the row position, and 0 is highest. Evidence signals such as malware, KEV and weaponized exploits match on presence; score signals take a comparison or a range, so "CWSS between 4 and 7" is a single row. One rule stays pinned at the bottom, All remaining, which sweeps up whatever the rules above did not catch, oldest first. Activate the strategy and the ranking applies wherever the queue appears: the What to fix first view, the dashboard priority widget, and the findings API.