Source-linked AI summary
ThreatLens: Evidence-Guided Ranking of High-Priority CVEs
Soroush Motamedi Sedeh, Panteha Shahrivar, Malaika Qureshi, Ali Devjiani, Mohammad A. Tayebi
TL;DR
Security teams need to prioritize vulnerabilities before exploitation evidence is complete, but existing signals are fragmented and retrospective evaluation can use unavailable evidence. ThreatLens ranks cutoff-aligned CVE snapshots with future KEV entry as weak supervision, and forward-in-time, CVE-disjoint evaluation shows strong top-K and early-warning performance. Its rankings estimate global exploitation relevance and should be combined with organization-specific risk information.
Problem
Security teams must prioritize continuously disclosed vulnerabilities under limited review time, while existing severity and exploitation signals are fragmented, time-sensitive, and vulnerable to retrospective leakage.
Method
ThreatLens ranks CVE-time snapshots using only cutoff-valid public evidence and learns relative priority from future CISA KEV entries as weak supervision.
Results
80.0% Recall@20 and 95.9% Recall@50 were achieved on the held-out test split, with 70.8% global PR-AUC and early surfacing before formal KEV entry.
Takeaways & Limitations
ThreatLens provides an evidence-backed triage compression layer for timely review before vulnerabilities are broadly recognized as urgent, without replacing expert judgment.
Takeaways & Limitations
KEV is incomplete and reflects cataloging and reporting decisions, while ThreatLens estimates global exploitation relevance rather than organization-specific risk.
Abstract
from arXiv · showhide
Security teams must prioritize vulnerabilities before exploitation evidence is complete. Existing signals, such as CVSS, EPSS, advisories, and public exploits, are useful but fragmented and time-sensitive; retrospective rankings can therefore overstate performance by using evidence unavailable at decision time. We present ThreatLens, a simple yet effective and deployment-realistic framework for CVE prioritization. ThreatLens ranks vulnerabilities at each review point using only cutoff-valid evidence and learns from future CISA KEV entries as weak supervision for exploitation relevance. Under forward-in-time, CVE-disjoint evaluation, ThreatLens significantly outperforms CVSS, EPSS, and rule-based evidence-fusion baselines. On the held-out test split, ThreatLens surfaces 80.0% of future KEV CVEs in the top 20, over three times EPSS at the same budget, and reaches 95.9% in the top 50. Early-warning analysis further shows that ThreatLens identifies a substantial fraction of subsequent KEV entries before formal catalog inclusion, supporting timely, evidence-grounded triage.
1 Introduction
ThreatLens frames CVE prioritization as a time-aware ranking problem under limited analyst review budgets, using only cutoff-valid evidence. It integrates heterogeneous public signals and evaluates forward-in-time prioritization against future KEV outcomes.
- Security teams must triage continuously disclosed CVEs under limited investigation time, making equal urgency impractical.
- Analysts rank CVEs within time-bounded candidate pools using evidence available at each decision point, rather than classifying vulnerabilities retrospectively.
- ThreatLens represents each vulnerability as a CVE-time snapshot and uses future CISA KEV entry as weak supervision for exploitation-relevant prioritization.
- ThreatLens integrates NVD descriptions, CVSS, EPSS, GHSA activity, and public exploit signals, aligned to weekly ranking cutoffs to avoid temporal leakage.
- 80.0% Recall@20 and 95.9% Recall@50 were achieved on the held-out test split, alongside 70.8% global PR-AUC and early surfacing before formal KEV entry.
- The evaluation uses a large-scale, forward-in-time, CVE-disjoint test design to measure prioritization under deployment-like conditions.
2 Related Work
Prior work identifies incomplete and fragmented exploitation signals, while emphasizing temporal leakage and retrospective evaluation as central challenges. ThreatLens builds on this literature by evaluating ranking within recurring, budgeted analyst queues using cutoff-valid evidence.
- CVSS can generate excessive alerts and poorly reflect exploitation, while EPSS and KEV provide complementary but incomplete signals.
- EPSS combines severity, exploit availability, and advisory activity, while other learned models use metadata, exploit evidence, timestamps, and references.
- Temporal leakage and the perfect labeling assumption arise when evaluation uses evidence unavailable at prediction time.
- ThreatLens addresses temporal realism with cutoff-aligned weekly snapshots, forward-in-time splits, and CVE-disjoint partitions.
- The framework treats prioritization as an operational ranking process, measuring whether future KEV entries enter small weekly top-K review budgets.
3 Data Characteristics
ThreatLens converts heterogeneous public intelligence into weekly CVE-time snapshots for ranking under evolving evidence. The data exhibit severe imbalance, repeated but changing snapshots, and distinct early-versus-late KEV evidence patterns.
- Weekly snapshots combine NVD, CISA KEV, EPSS, GHSA, Exploit-DB, and Metasploit evidence at each cutoff.
- 269,331 snapshots across 233 weekly cutoffs cover 158,217 unique CVEs, with positives comprising 1.96% of snapshots.
- The median weekly pool contains 510 candidates, including 10 positives and 500 negatives, reflecting small review sets drawn from large candidate pools.
- Late KEV entrants have higher EPSS scores and percentiles, whereas early entrants have shorter public-exploit recency; all three differences are statistically significant.
- EPSS score, EPSS percentile, and GHSA advisory count change in 60.9%, 87.5%, and 28.4% of consecutive same-CVE snapshot pairs.
- KEV timing reflects exploitation, disclosure, cataloging, and reporting dynamics rather than exploitation onset alone.
4 Vulnerability Prioritization
ThreatLens formulates vulnerability prioritization as a cutoff-aligned ranking pipeline that converts time-bounded public evidence into weekly review queues. It preserves temporal validity while comparing multiple evidence representations and scorers under analyst review budgets.
- Problem formulation: ThreatLens ranks CVE-time snapshots into weekly analyst review queues using only evidence available at each cutoff.The pipeline evaluates whether high-risk CVEs are surfaced before KEV entry.
- Snapshot construction: Each cutoff-specific candidate pool contains known CVEs that have not already entered KEV, preserving the deployment-time ranking structure.Future KEV entry within a prediction horizon supplies the weak-supervision label, while the same CVE can change label across cutoffs.
- Evidence construction: Cutoff-valid evidence combines NVD context, CVSS, EPSS, GHSA advisories, Exploit-DB, and Metasploit signals, with time-varying sources aligned to the review cutoff.Dates and identifiers that could expose unavailable information are removed or transformed into relative or aggregate features.
- Temporal leakage mitigation: NVD fields are leakage-mitigated but not perfectly historical because exact historical NVD record revisions are not reconstructed.The study removes mutable or leakage-prone fields and tests potentially non-historical information through baselines and ablations.
- Representations: ThreatLens uses evidence text and structured tabular features to test whether performance derives from aligned evidence, compact summaries, or neural text representation learning.The text representation includes vulnerability context, severity, EPSS, advisory, exploit, and relative temporal information.
- Scoring models: The neural scorer learns pairwise priority between positive and negative snapshots from the same cutoff, while the structured scorer uses class-weighted logistic regression.This objective ranks vulnerabilities competing for analyst attention rather than treating exploitation relevance only as binary classification.
5 Evaluation
ThreatLens is evaluated as a deployment-style, time-aware ranking system using cutoff-valid evidence, forward-in-time splits, and CVE-disjoint evaluation. Learned rankers outperform standalone signals and demonstrate early-warning ability before KEV entry, with gains supported by multi-source evidence integration.
- Experimental Design: ThreatLens evaluates weekly ranking of future KEV CVEs within fixed analyst review budgets using cutoff-valid evidence and forward-in-time, CVE-disjoint splits.The candidate pool includes CVEs published by each cutoff and not yet in KEV; positives enter KEV within 30 days.
- Main Ranking Results: 80.0% Recall@20: TL-LR surfaces more than three times as many future KEV vulnerabilities as EPSS at a weekly review budget of 20.The comparison is 80.0% versus 24.7% Recall@20.
- Main Ranking Results: TL-NR increases Recall@20 from 61.7% to 75.6% and global PR-AUC from 43.8% to 57.1% over TL-TF-IDF.The result indicates useful semantic signal beyond shallow lexical matching.
- Main Ranking Results: 95.9% Recall@50 and 70.8% global PR-AUC: TL-LR is the strongest aggregate scorer on the held-out test split.TL-LR also achieves 73.9% macro PR-AUC and remains lightweight and interpretable.
- Main Ranking Results: The strongest model is a structured logistic ranker rather than the largest neural model, emphasizing decision-time representation over model complexity.The structured ranker combines temporal, exploitation-likelihood, severity, advisory, and public-exploit features.
- Early-Warning Evaluation: 90 of 92 held-out KEV CVEs are surfaced in the top 50 before KEV entry by TL-LR, compared with 25 of 92 for EPSS.This is reported for the strict forward-time early-warning setting.
- Early-Warning Evaluation: Learned scorers achieve median top-50 warning times of approximately 25 days in forward time and 28 days in the 10-fold KEV-target setting.The broader 10-fold setting provides historical coverage, while strict forward time provides the more realistic deployment estimate.
- Ablation Study: Ablations show that ThreatLens gains persist without EPSS or CVSS, supporting integration of multiple cutoff-aligned evidence sources.TL-LR without EPSS achieves 77.3% Recall@20, while TL-LR without CVSS achieves 79.7% Recall@20.
6 Operational Implications
ThreatLens supports analyst-facing triage by combining structured and textual evidence to surface operationally significant vulnerabilities before KEV inclusion. Its rankings estimate global exploitation relevance, so deployment should incorporate local risk factors and downstream validation.
- Structured scoring provides a lightweight prioritization backbone, while text representations surface risk expressed through product context, advisory language, or exploit terminology.The paper presents the two representations as complementary rather than identifying one universally dominant model family.
- ThreatLens should function as a triage compression layer rather than an autonomous remediation oracle.Downstream retrieval, explanation, and validation modules support investigation and remediation decisions.
- 42 days before KEV inclusion, ThreatLens ranked CVE-2023-52163 within the top 10 while EPSS ranked it 152nd at the same cutoff.The vulnerability affected DigiEver network video recorders and was later linked to the ShadowV2 IoT botnet.
- 30 days before KEV inclusion, ThreatLens ranked CVE-2026-20963 9th while EPSS ranked it 166th at the same cutoff.The case involved a Microsoft SharePoint remote-code-execution vulnerability and later warnings about active exploitation against internet-exposed deployments.
- ThreatLens estimates global exploitation relevance, so rankings should be combined with local asset exposure, patch status, business criticality, and network reachability.KEV entry also reflects exploitation, disclosure, cataloging, and operational prioritization dynamics rather than a single risk dimension.
7 Conclusion
ThreatLens reframes vulnerability prioritization as an operational early-warning problem and uses temporally valid evidence to compress a large CVE stream into an evidence-backed review queue. It supports, rather than replaces, expert judgment under uncertainty.
- ThreatLens treats vulnerability prioritization as an operational early-warning problem rather than a static severity-ranking task.
- The framework continuously fuses public evidence about vulnerabilities, advisories, exploit availability, and exploitation likelihood.
- ThreatLens turns a large weekly stream of newly relevant CVEs into a smaller, evidence-backed review queue for timely analyst decisions.
- ThreatLens helps focus expert judgment on vulnerabilities whose evolving evidence profile indicates emerging operational risk.
8 GenAI Usage Disclosure
The authors disclose using generative AI tools for writing, revision, manuscript development, and research communication, while retaining responsibility for the research and submitted work.
- Generative AI tools assisted with writing, revision, manuscript development, and research communication.
- The authors retained responsibility for research design, implementation, experiments, analyses, results, interpretations, claims, and final manuscript content.