Don't let CVEs distract you: Shift your AppSec team's focus to malware

The report argues that the current CVE/NVD ecosystem is overburdened by low-quality, high-volume vulnerability reports and rigid scoring, urging AppSec teams to focus on exploitability and concrete evidence of compromise (malware and tampering) rather than chasing theoretical issues. It highlights CVSS v4.0 and EPSS as complementary approaches for more nuanced, threat-informed prioritization, with experts advocating a balanced strategy that also accounts for IoT/OT/ICS realities.