Decoding NIST CSWP 41: Predicting Vulnerability Exploitation Metrics

The discussion in this podcast covers the introduction of the Likely Exploited Vulnerabilities (LEV) metric, proposed in NIST Cybersecurity White Paper 41 by Peter Mell and Jonathan Spring to address a critical gap in the "remediation deficit" where organizations can typically only patch a small fraction of annual CVEs. LEV functions as a retrospective, probabilistic score that compounds historical Exploit Prediction Scoring System (EPSS) data to estimate the cumulative likelihood that a vulnerability has already been exploited in the past, thereby correcting the "past-exploitation blindness" of forward-looking models. The metric is designed to complement rather than replace existing frameworks, offering use cases for measuring the comprehensiveness of the CISA Known Exploited Vulnerabilities (KEV) catalog and enhancing prioritization through a Composite Probability score—defined as the maximum signal of EPSS, LEV, and KEV. Technical advancements discussed alongside these metrics include the FORGE multi-agent system for automated exploit generation and Bayesian Network models for real-time, adaptive decision support in critical infrastructure. Despite its mathematical utility, the LEV framework has prompted significant industry debate regarding its "independent events" assumption, the validity of its LEV2 daily-linear approximation, and the risk of "triage inflation" by permanently elevating the priority of dormant legacy threats. Collectively, the discussion highlight a strategic shift toward evidence-driven exposure management and rigorous operational mandates, such as CISA BOD 26-04, which requires federal agencies to prioritize remediation based on active threat telemetry and forensic compromise checks.