Find what matters, fix what's exploitable.

The Common Vulnerability Scoring System (CVSS) was designed to provide a standardized measure of a vulnerability's intrinsic severity — how serious would this flaw be under worst-case conditions, in a generic environment, assuming an attacker is present and motivated to exploit it? A CVSS base score reflects technical characteristics: attack vector (network vs. local), attack complexity (low vs. high), privileges required, user interaction required, and the potential impact on confidentiality, integrity, and availability. What CVSS explicitly does not measure is whether anyone is actually exploiting this vulnerability, whether exploit code is publicly available, or whether this specific vulnerability has been used in attacks against organizations similar to yours. These are the factors that determine actual risk.

The practical problem with CVSS-driven patching is prioritization inversion. A vulnerability with a CVSS score of 9.8 — rated "Critical" — may have been disclosed years ago with no public exploit, no evidence of in-the-wild use, and no known threat actors targeting it in your industry. A vulnerability with a CVSS score of 6.5 — rated "Medium" — may have a working public exploit published on GitHub the week it was disclosed, active use in ransomware campaigns documented by CISA, and specific evidence of exploitation against SMBs in your sector. Under CVSS-driven prioritization, the organization patches the 9.8 first and the 6.5 sixth. Under exploit-aware prioritization, the order reverses. For an SMB IT team with limited patching bandwidth, this difference is material: patching the wrong vulnerability first under time pressure means the exploited vulnerability remains open while lower-risk items are closed.

Two data sources significantly improve on raw CVSS scores for SMB patch prioritization. CISA's Known Exploited Vulnerabilities (KEV) catalog is a maintained list of vulnerabilities that CISA has confirmed are being actively exploited in the wild. As of mid-2024, the KEV catalog contains over 1,100 entries. A vulnerability on the KEV list should be treated as Priority 1 regardless of its CVSS score, because active exploitation is confirmed. EPSS (Exploit Prediction Scoring System), maintained by FIRST.org, is a probabilistic model trained on millions of vulnerabilities and historical exploitation data that estimates the likelihood that a given CVE will be exploited within the next 30 days. EPSS scores above 0.4 (40% probability of exploitation) represent a much smaller, more actionable set of vulnerabilities than CVSS "High" and "Critical" classifications, which typically cover 15–20% of all CVEs in a given scan.

Quantm builds the weekly remediation priority list using a combination of these signals: KEV presence (immediate priority regardless of score), EPSS score above threshold (elevated priority), CVSS score as a tiebreaker when no exploit data is available, and asset criticality (a vulnerability on a publicly accessible server or a domain controller is more urgent than the same vulnerability on an isolated internal workstation). This approach typically reduces the "must patch this week" list from hundreds of findings to a single-digit or low double-digit set of specific CVEs on specific assets — a volume that a small IT team can actually close within the SLA window rather than accumulating indefinitely as technical debt.

External Attack Surface Management (EASM) is the discipline of continuously discovering and assessing all internet-facing assets associated with an organization — whether or not those assets are known to the IT team. The phrase "whether or not known" is the critical qualifier. Most SMBs have a mental model of their internet exposure that consists of their primary website, their email server, and their VPN gateway. The actual exposure typically includes: forgotten subdomains hosting old marketing microsites or development environments, expired TLS certificates on secondary domains, SaaS applications provisioned by individual employees with no IT involvement, third-party integrations exposing internal APIs, and cloud storage accounts created outside the formal IT process. EASM tooling discovers these assets by querying DNS records, certificate transparency logs, passive DNS databases, and internet-wide scanning infrastructure — the same sources that attackers use to map your exposure before launching an attack.

The gap between self-reported attack surface and actual attack surface in Canadian SMBs is consistently larger than organizations expect. Certificate transparency logs alone — publicly available logs maintained by Google, Digicert, and other Certificate Authorities — record every TLS certificate ever issued for a domain, including certificates for subdomains that an organization may not even remember registering. A threat actor who queries these logs against your primary domain may discover a development environment subdomain running an unpatched CMS, a staging environment with default credentials, or a portal used by a former SaaS vendor that was never decommissioned. Subdomain takeover — where an attacker registers a cloud resource to claim a dangling DNS record pointing to a deleted asset — is a specific and frequently underestimated risk that EASM discovers by identifying DNS records pointing to unclaimed resources.

The operational difference between continuous EASM and annual penetration testing matters significantly for risk management. A penetration test produces a point-in-time snapshot of the attack surface as it existed on the date of the test. Between tests, new assets are provisioned, new vulnerabilities are disclosed for existing assets, certificates expire, and the threat landscape evolves. Continuous EASM scanning detects changes to the attack surface as they occur: a new subdomain created by a developer, a newly disclosed CVE affecting a product version you run on an internet-facing server, a TLS certificate approaching expiry that will generate browser warnings and create an impersonation opportunity. For Canadian SMBs that cannot afford monthly penetration tests, continuous EASM provides ongoing attack surface awareness at a cost point comparable to a single annual test, with the advantage that findings are current rather than twelve months stale.

EASM also captures a category of risk that internal vulnerability scanning misses entirely: exposed credentials and data appearing in third-party breach dumps and paste sites. When an employee's credentials from a breached external service appear in a public data dump, that credential is available to any threat actor who monitors breach data — and if the employee reuses that password on any corporate system, the organization is compromised before the employee or IT team is even aware of the breach. EASM platforms that include breach monitoring surface these exposures in near-real-time, allowing Quantm to issue credential reset notifications before attackers can weaponize the exposure. In environments where password reuse is common — which is the case in the majority of SMBs without a mature password management program — this capability alone justifies the cost of continuous external attack surface monitoring.