As Artificial Intelligence-assisted vulnerability hunting has become more commonplace, we have seen a flood of new vulnerabilities across our feeds and attackers taking advantage of them. In fact, there were 48,000+ CVEs in 2025 alone with vulnerabilities rising to become the top initial access vector in the Verizon 2026 DBIR report. It can make the task of keeping up feel impossible and even encourage dangerous attitudes like resignation or impulsivity. Our human brains can only receive so much before they start tuning things out due to alert fatigue. Are we approaching the "vulnerabilities that cried wolf" moment?
I think we are beyond the vulnerabilities that cried wolf problem. It comes down to a couple things:
CVSS Score is used as a risk score. Management/Executives see/hear of a high CVSS score and automatically freak out about a patch. We need to set time to see what our actual risk is on it
Freaking out about items a company doesn’t have. This boils down to a poor inventory system to do a quick search if a company has software X or hardware Y and what version it is on. Inventory has always been an issue from a security standpoint and as far as vulns go, it is even worse.
So for #1 the obvious way to work it is to build a trust level with the Management/Execs on risk assessment for CVEs. The more they trust that we will give a proper assessment and take care of high priority issues fast the better.
#2 is obviously having a good Inventory management system complete with SBOMS that is searchable so we know what we are dealing with( this also helps with #1) .
I know some folks at work are considering the use of EPSS for prioritization rather than CVSS. I’m still personally on the fence, as I’ve seen stuff that was zero-day/straight to the KEV maintain a low EPSS score. That might accurately reflect the risk for any random case where the vulnerability is present, but it doesn’t necessarily match our risk.
