The impossible inbox

At 16:00 UTC on August 2, 2026, ExploitRank's public snapshot had 8,218 eligible CVEs.

It also had 411 review seats.

That mismatch is the whole design problem. A vulnerability feed can grow all day. An analyst's day stubbornly refuses to do the same. If the system calls everything important, it has not prioritized anything; it has merely added a sort button to panic.

I wanted ExploitRank to answer a narrow operational question: what deserves a bounded slice of attention today? Not “what is dangerous forever,” not “what affects my environment,” and not “which number looks most alarming in a screenshot.”

Queues are promises disguised as lists. If a queue has no capacity limit, it is promising work nobody can finish.

Two easy answers, both wrong

The first tempting answer is to sort by CVSS and start at the top. CVSS describes technical severity. That matters, but severity is not a calendar invite. A severe vulnerability may be unreachable in one environment while a less dramatic one is already being exploited somewhere else.

The second tempting answer is to sort by FIRST EPSS and treat the first rows as “the vulnerabilities most likely to hit us.” EPSS estimates the probability that a published CVE will be exploited in the next 30 days. It does not know my asset inventory, internet exposure, compensating controls, business impact, or whether the product is installed at all. EPSS is useful. It is not a tiny oracle wearing a percentage sign.

CISA KEV answers yet another question: has exploitation been observed in the wild? Forecast, severity, and observed use are related evidence, not interchangeable labels.

Combining them into one grand score would make the dashboard look decisive. It would also make the meaning of a row nearly impossible to explain.

The boring rule won

I chose a fixed budget for the forecast lane: 5% of the eligible CVE population.

8,218 eligible CVEs x 5% = 410.9 -> 411 review seats

The metadata receipt exposes the eligible count, budget, and selected count, so the arithmetic can be checked without access to the private backend.

Five percent is not sacred. It is a policy knob that makes capacity explicit. The important property is not the particular number; it is that adding another thousand eligible CVEs cannot quietly turn today's review into next month's archaeological dig.

This is an attention constraint, not a new exploitation probability. Membership means “inside today's bounded forecast review,” nothing more glamorous.

A forecast is not a sighting

The dashboard keeps three states separate:

forecast queue -> recent exploitation -> known exploited
  • Forecast queue: public forecast evidence placed the CVE inside the current review budget.
  • Recent exploitation: time-bounded public evidence says exploitation was observed recently.
  • Known exploited: durable known-use evidence is present, including CISA KEV.

Suppose a CVE begins in the forecast queue. If qualified evidence of active exploitation appears, the record should not keep masquerading as a prediction; it moves into an observed-evidence state. If it enters KEV, that known-use fact should not evaporate because tomorrow's EPSS ranking changes.

That distinction sounds fussy until a forecast is repeated in a meeting as a sighting. Then it becomes the difference between useful prioritization and threat-intelligence telephone.

Where the rule stops

The public dashboard does not determine whether a CVE affects a specific environment. It does not replace asset inventory, vendor guidance, version checks, exploitability analysis, or local exposure evidence. It does not turn absence from the queue into “safe.”

EPSS is not impact. KEV membership is not universal applicability. A MITRE ATT&CK technique label is not attribution. The 5% budget controls attention; it does not complete a risk assessment.

The rule should change when the work changes. If the analyst capacity, eligible universe, review cadence, or observed miss rate changes, 5% may be the wrong budget. A fixed policy is useful because it can be measured and revised—not because it arrived on a stone tablet.

Show the receipt

The live ExploitRank dashboard exposes current evidence states and public receipts. The artifact repository contains the generated dashboard assets, not backend source, databases, snapshots, credentials, or private history.

That split is deliberate. A reviewer should be able to challenge the public claim without being handed everything the system knows.

The arithmetic is the least sophisticated part of ExploitRank. Good. It means the argument can happen where it belongs: over the evidence, the budget, and what each label is allowed to mean.