What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A Critical rating tells you how serious a flaw could be if it is exploited. It does not tell you whether anyone is exploiting it, or whether the vulnerable code runs and can be reached in your environment. No authoritative source publishes a measured share of Critical vulnerabilities that are never exploited, so the idea that most of them are never exploited cannot be stated as a number. What you can do is keep three questions apart: how severe the flaw is, how likely or how confirmed its exploitation is, and whether it matters in your deployment. Each question needs its own evidence.
Why a Critical label is not an exploitation record
CVSS severity describes the technical characteristics of a flaw and how much damage exploitation could do. It is assigned from the vulnerability itself, not from observed attacks, and it says nothing about whether the vulnerable code is present in your systems.
As an Amazon Associate I earn from qualifying purchases.
The underlying problem is a mismatch between two kinds of evidence. Scanners and advisories are static: they read a manifest, lockfile, or image and report that a vulnerable version exists somewhere in the inventory. Exploitability is a runtime question: whether the component is actually shipped to production, whether the vulnerable function is invoked, whether input an outside party can influence reaches that function, and whether the asset holds anything worth attacking. A severity score stops being useful on its own at exactly the point where those runtime facts begin to matter.
What the “most never get exploited” claim can and cannot support
The intuition behind the title is plausible, but the evidence does not support a percentage. The closest official statement comes from NIST CSWP 41, Likely Exploited Vulnerabilities: A Proposed Metric for Vulnerability Exploitation Probability, written by Peter Mell (NIST) and Jonathan Spring (CISA) and published May 19, 2025. Its abstract says: “Only a small fraction of the tens of thousands of software and hardware vulnerabilities that are published every year will be exploited.” That is a qualitative statement about all published vulnerabilities. It is not a measured proportion for the Critical subset, and it cannot be turned into a claim that any particular Critical flaw will never be exploited, because no observation window can prove a negative.
#1 Best Overall
The defensible version of the thesis is narrower: a Critical rating is not evidence of exploitation, and severity, exploitation evidence, and local exposure should be assessed separately.
Source: NIST CSWP 41.
Three signals that answer different questions
The main signals are complementary, not interchangeable. Each answers a different question, and each has a limit that a reader should keep in view.
| Signal | Question it answers | What it cannot tell you |
|---|---|---|
| CVSS severity | How serious is the flaw if it is exploited? | Whether anyone is exploiting it, or whether the vulnerable code is present and reachable in your deployment |
| CISA Known Exploited Vulnerabilities (KEV) catalog | Has CISA recorded this vulnerability as known to be exploited in the wild? | Whether a flaw missing from the catalog is safe. Absence is not proof that exploitation has not occurred |
| EPSS (FIRST) | What is the estimated probability of exploitation in the wild over the next 30 days? | Whether the component is in your deployment, or what happens to your assets if it is exploited |
| Deployment context (inventory, reachability, exposure, impact) | Is the component present, reachable, exposed, and consequential in this environment? | Anything beyond your own inventory and configuration data. Quality depends on what your organization or tool actually collects |
CISA KEV: confirmed exploitation as an input
The KEV catalog lists vulnerabilities CISA knows to have been exploited in the wild. The catalog page states: “Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.” The catalog is updated continuously, so a vulnerability’s membership is a date-sensitive fact. A listing is a strong reason to act quickly. It is still one input, and it does not measure how exposed your systems are.
EPSS: a probability, not a verdict
FIRST’s Exploit Prediction Scoring System (EPSS) estimates the likelihood that a vulnerability will be exploited in the wild over the next 30 days. FIRST says the model draws on several kinds of signal, including exploitation telemetry, threat intelligence, exploit code availability, vulnerability description language, product characteristics, and weakness classifications. Its “Why EPSS?” methodology page describes approximately 2,800 features. That figure is FIRST’s own description of the model as currently documented, and it may change as the model is updated.
Rank #3
Two practical consequences follow. An EPSS score is a forecast that moves over time, so record the score together with the date you retrieved it. A low score means the model estimates little near-term exploitation across the vulnerability population. It does not show that a specific installation is safe. FIRST’s list of EPSS publications includes the original 2021 peer-reviewed paper and later evaluations, which is where to check the model’s published performance work.
NIST’s LEV proposal: a metric still under evaluation
The same NIST paper proposes “Likely Exploited Vulnerabilities” (LEV) as a metric for exploitation probability. The authors describe it as a proposal and call for industry collaboration to measure its performance. It has not displaced EPSS or KEV, and it should not yet be treated as an established input to a prioritization process.
Closing the static-to-runtime gap: a workflow for each finding
The practical goal is to move each finding from “a vulnerable version exists somewhere in our inventory” to “this specific asset is exposed to this specific flaw, and here is the evidence.” Work through the steps below for every Critical finding.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors- Confirm presence in the deployed artifact. Check the running container image, the deployed package set, or a software bill of materials generated from the build output, not just the source manifest. A dependency that exists only in a build or test stage carries a different risk from one shipped to production.
- Identify the assets that carry it. List each service, host, or image that includes the component, with its owner, the sensitivity of the data it handles, and whether it can be reached from outside your network.
- Test reachability in the deployed configuration. Determine whether the vulnerable function or code path is invoked, and whether input an untrusted party can influence reaches it. Record the evidence: a call trace, a configuration setting, or a documented reason the path is disabled.
- Check KEV. Note whether the CVE is listed, and the date you checked.
- Check the current EPSS score. Record the score and its retrieval date. Use it to order findings that have similar impact and reachability, not to override the earlier steps.
- Estimate post-exploitation impact and the available fix. Consider what an attacker could reach from the compromised component, and whether a patch, a version upgrade, or a verified mitigation exists.
- Decide, record the decision, and set a reopen trigger. If you accept the risk or rely on a compensating control, record the owner, the rationale, an expiry date, and the events that should reopen the finding, such as a KEV addition, a change in exposure, or a configuration change.
Decision patterns
The table shows how the evidence usually changes handling. These are editorial patterns, not thresholds drawn from a standard. Adjust them to your own policy and risk tolerance.
Best Value
| Scenario | Typical handling |
|---|---|
| Present in production, reachable from untrusted input, externally exposed, and listed in KEV | Treat as urgent. Patch or apply a verified mitigation now, and record the date of the KEV check. |
| Present in production, reachable, internal only, not in KEV, low EPSS score | Schedule the fix on your standard Critical timeline, and recheck KEV and EPSS when the finding is reviewed. |
| Package absent from the deployed artifact, for example present only in a build tool | Verify against the running image or deployed package set, close the finding with that evidence, and recheck after the next build. |
| Present in production but not reachable in the deployed configuration | Document the call-path evidence and an owner, and reopen the finding if the configuration, code path, or exposure changes. |
| Low EPSS score, not in KEV, but exposed and with high post-exploitation impact | Do not deprioritize on EPSS alone. Fix on a time-bound schedule. |
Federal context: CISA BOD 26-04
CISA’s Binding Operational Directive 26-04, on prioritizing security updates based on risk, is dated June 10, 2026, according to its summary. The summary lists prioritization factors that include asset exposure, KEV status, exploit automation, and post-exploitation technical impact, which align with the workflow above. Binding operational directives are written for federal civilian agencies. Their deadlines do not automatically apply to private organizations, although the factors can serve as a useful model. Secondary copies of federal directives can differ from the original, so confirm the date and scope on CISA’s own directive page at cisa.gov before citing them in a compliance document.
Evaluating scanners and prioritization platforms
Tools that promise to close the static-to-runtime gap differ mainly in whether they can support the steps above. Use the following questions in a procurement comparison, and verify each answer against your own images and repositories rather than accepting a vendor description:
- How is the component inventory built: from source manifests, built images, or running hosts? How accurate is it against what is actually deployed?
- Which languages and package ecosystems are covered, and how are transitive dependencies handled?
- Does the tool show reachability evidence that a reviewer can inspect? Can it distinguish a package that is absent from one that is present but unreachable?
- Where do exploitation signals come from, when were they last updated, and is the source recorded with each finding?
- Can findings be mapped to deployed assets, with exposure, ownership, and business context?
- Does it support exceptions and compensating controls with owners, expiry dates, and reopen triggers?
- Does it integrate with ticketing and build pipelines, so that rebuilds update findings and closures can be audited?
Reachability is not standardized. Teams and vendors define and measure it differently, so ask each tool what it counts as reachable and what evidence supports that conclusion.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
