Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces ThreatLens, a novel framework for prioritizing Common Vulnerabilities and Exposures (CVEs) that utilizes only available evidence at the time of decision-making, avoiding retrospective biases. By leveraging weak supervision from future CISA Known Exploited Vulnerabilities (KEV) entries, ThreatLens significantly enhances the accuracy of vulnerability rankings compared to traditional methods like CVSS and EPSS. The framework achieved a remarkable 80.0% recall of future KEV CVEs within the top 20 rankings, demonstrating its efficacy in providing timely, evidence-based triage for security teams.
ThreatLens identifies 80% of future high-priority vulnerabilities before they are formally cataloged, revolutionizing how security teams prioritize threats in real-time.
Security teams must prioritize vulnerabilities before exploitation evidence is complete. Existing signals, such as CVSS, EPSS, advisories, and public exploits, are useful but fragmented and time-sensitive; retrospective rankings can therefore overstate performance by using evidence unavailable at decision time. We present ThreatLens, a simple yet effective and deployment-realistic framework for CVE prioritization. ThreatLens ranks vulnerabilities at each review point using only cutoff-valid evidence and learns from future CISA KEV entries as weak supervision for exploitation relevance. Under forward-in-time, CVE-disjoint evaluation, ThreatLens significantly outperforms CVSS, EPSS, and rule-based evidence-fusion baselines. On the held-out test split, ThreatLens surfaces 80.0% of future KEV CVEs in the top 20, over three times EPSS at the same budget, and reaches 95.9% in the top 50. Early-warning analysis further shows that ThreatLens identifies a substantial fraction of subsequent KEV entries before formal catalog inclusion, supporting timely, evidence-grounded triage.