CISA added seven vulnerabilities to its Known Exploited Vulnerabilities catalog on September 2, based on evidence that the vulnerabilities are being actively exploited. The additions span different types of enterprise technology, including remote access appliances, application infrastructure, development tools and an AI gateway.

That creates a practical problem for IT and security teams.

Most organizations do not have the option of treating every vulnerability with the same urgency. The challenge is deciding which vulnerabilities create the greatest immediate risk to the business.

A high severity score can be useful, but it does not tell the whole story.

An actively exploited vulnerability affecting an internet facing system may deserve attention before a theoretically more severe vulnerability affecting an isolated internal system.

The same applies to business context.

A vulnerability in an application supporting a critical business process may have a very different operational impact from one affecting a system with limited business dependency.

This makes vulnerability management less about maintaining a perfect patching list and more about understanding risk.

For technology leaders, that means connecting several pieces of information:

• Is the vulnerability being actively exploited?

• Is the affected system exposed?

• What business processes depend on it?

• How important is the affected asset?

• Can the vulnerability be mitigated quickly?

• Has the organization tested what happens if the system becomes unavailable?

CISA's Known Exploited Vulnerabilities catalog is designed to help organizations prioritize vulnerabilities that have evidence of exploitation.

But the technology team still has to put that information into its own environment and business context.

For security and IT leaders, is your vulnerability program primarily driven by severity scores, or by actual business risk?