Skip to content
ZK
ZAIN KHALIL KHAN
PORTFOLIO
All projects

Interactive build

PatchPilot | Exploit-Aware Vulnerability Prioritisation

Vulnerability prioritisation engine that scores findings as likelihood times impact, drawing likelihood from EPSS and known-exploited status and impact from asset exposure and tier, then assigns remediation SLAs and shows how badly a CVSS-only sort misorders the queue.

Live demo readyVulnerability Management + EPSS
Vulnerability ManagementEPSSCVSSRisk ScoringPatch ManagementSecurity OperationsCase study / interactive demo

Case study

From problem to working system

Problem

Vulnerability prioritisation engine that scores findings as likelihood times impact, drawing likelihood from EPSS and known-exploited status and impact from asset exposure and tier, then assigns remediation SLAs and shows how badly a CVSS-only sort misorders the queue.

My role

Security engineer and full-stack developer

Solution

Vulnerability prioritisation engine that scores findings as likelihood times impact, drawing likelihood from EPSS and known-exploited status and impact from asset exposure and tier, then assigns remediation SLAs and shows how badly a CVSS-only sort misorders the queue.

Architecture

The implementation combines the following technologies and system concerns.

Vulnerability ManagementEPSSCVSSRisk ScoringPatch ManagementSecurity Operations

How it was built

  • Separated severity from risk: CVSS describes how bad a flaw is in the abstract, while EPSS and known-exploited status describe whether anyone is actually using it.
  • Weighted impact by network exposure and asset tier so an internet-facing appliance outranks an isolated lab sensor holding a higher-scoring CVE.
  • Discounted risk where a compensating control is documented, keeping the queue honest rather than ignoring mitigations.
  • Derived remediation SLAs from the computed score, so the emergency bucket is defined by risk rather than by whoever escalated loudest.

Security decisions

  • Separated severity from risk: CVSS describes how bad a flaw is in the abstract, while EPSS and known-exploited status describe whether anyone is actually using it.
  • Discounted risk where a compensating control is documented, keeping the queue honest rather than ignoring mitigations.
  • Derived remediation SLAs from the computed score, so the emergency bucket is defined by risk rather than by whoever escalated loudest.

Major challenges

  • Separated severity from risk: CVSS describes how bad a flaw is in the abstract, while EPSS and known-exploited status describe whether anyone is actually using it.
  • Weighted impact by network exposure and asset tier so an internet-facing appliance outranks an isolated lab sensor holding a higher-scoring CVE.
  • Discounted risk where a compensating control is documented, keeping the queue honest rather than ignoring mitigations.

Verified evidence

Results and measurable impact

  • Discounted risk where a compensating control is documented, keeping the queue honest rather than ignoring mitigations.
  • Derived remediation SLAs from the computed score, so the emergency bucket is defined by risk rather than by whoever escalated loudest.
  • Included patch effort (hot patch, reboot window, rebuild) since a three-day SLA against a rebuild is a scheduling problem, not a patching one.
  • Provided a naive CVSS sort side by side, which is the clearest way to show a stakeholder why the prioritisation model exists.

No separate numeric outcome is documented, so this section shows shipped technical evidence without inventing metrics.

Screenshots and access

Product view

Open live project

Interactive Demo

A scoped, fully functional recreation of this project's core feature runs below, live in your browser. Reset it, resize it, or expand it to full screen.

PatchPilot

Security platform

PatchPilotWorkspace6 updates
PatchPilot · Exploit-Aware Prioritisationshare of findings inside the 3-day emergency window
1 emergency

Patching by CVSS alone puts an isolated lab sensor above an internet-facing VPN appliance. Risk here is likelihood times impact: EPSS and known-exploited status drive likelihood, exposure and asset tier drive impact, and compensating controls discount the result. Switch to the naive CVSS sort to see the difference.

Emergency (3 day)

1

Known exploited

3

on a KEV list

CVSS says patch

CVE-2024-7742

9.9 on lab-sensor-11

Risk says patch

CVE-2026-1041

edge-vpn-01, internet

Top riskCVE-2026-1041
98risk score
Why CVSS misorders this queue
CVSS picks CVE-2024-7742 on lab-sensor-11CVSS 9.9 · EPSS 1%
Risk picks CVE-2026-1041 on edge-vpn-01EPSS 94% · internet

CVE-2024-7742 scores higher on severity but sits on an isolated asset with 1% exploit probability. Severity is not risk.

Remediation queue7 findings
CVE-2026-1041edge-vpn-01KEVinternetemergency98
patch within 3 days

CVSS 9.8EPSS 94%likelihood 100%impact 98% tier1 reboot window

CVE-2025-9930web-front-02KEVinternetexpedited52
patch within 14 days

CVSS 7.5EPSS 71%likelihood 100%impact 52% tier2 no downtime

CVE-2025-8817mail-gwKEVinternetexpedited42
patch within 14 days

CVSS 5.3EPSS 44%likelihood 79%impact 53% tier1 no downtime

CVE-2026-0455file-share-01internalstandard26
patch within 30 days

CVSS 8.2EPSS 58%likelihood 58%impact 45% tier1 reboot window

CVE-2026-0887db-prod-03internalscheduled4
patch within 90 days

CVSS 9.1EPSS 12%likelihood 12%impact 50% tier1 reboot windowcompensating control applied, risk discounted 40%

CVE-2026-1188hr-portalinternalscheduled1
patch within 90 days

CVSS 6.1EPSS 3%likelihood 3%impact 23% tier2 no downtime

CVE-2024-7742lab-sensor-11isolatedscheduled0
patch within 90 days

CVSS 9.9EPSS 1%likelihood 1%impact 5% tier3 rebuild requiredcompensating control applied, risk discounted 40%

Zain Khalil Khan