How the Quatronics Weekly Vulnerability Brief Works

Why this exists

Every week, thousands of new security bugs get reported. For years, CISA sent a weekly email listing them, sorted mostly by how scary each bug sounded. On September 28 2026, CISA will discontinue that bulletin as part of its shift from severity‑based vulnerability management to a modern, risk‑based approach, one that prioritizes vulnerabilities based on real‑world risk factors, including evidence of exploitation and exposure, rather than severity scores alone. Our brief picks up where that email left off, built on the same idea.

The big idea: “Is anyone actually breaking in with this?”

Think of every bug as a broken lock somewhere in the world. A CVE is just the name tag on that lock. CVE-2026-12345 means “broken lock #12345, reported in 2026.” A CVSS score says how bad things could get if someone picked the lock. That’s useful, but it doesn’t tell you whether anyone is picking it.

KEV (CISA’s Known Exploited Vulnerabilities list) is different. It’s CISA saying “we’ve seen burglars use this lock.” That’s the strongest signal there is, so anything on KEV goes straight to the top of our brief. No math needed.

Where the information comes from

Every morning, our system collects new and updated CVEs from NIST’s National Vulnerability Database. It also pulls FIRST’s EPSS, which is a forecast of how likely a bug is to be exploited soon.

Every four hours, it checks four evidence sources. CISA KEV means burglars have been seen using the lock. Metasploit means a ready-made burglar tool exists, graded by how reliable it is. Exploit-DB means someone has published instructions for picking the lock. Nuclei means a tool exists that can scan the internet for that broken lock. KEV is a careful judgement, so it can lag behind. The other three are things that already exist and can be pointed at, and they often show up first.

How we grade each bug

Every bug gets three grades from 0 to 100:

• Threat asks “Is this dangerous right now?” It’s built from KEV, CISA’s SSVC ratings, EPSS, and the exploit tools above.
• Reach asks “Would a normal mid-size company have this?” A Microsoft or Fortinet bug scores high; a rare niche product scores low.
• Effort asks “How easy is the fix?” It’s flipped, so 100 means easy. A one-click patch scores high; “no patch, replace the hardware” scores low.

Threat counts for half of the final score, and reach and effort count for a quarter each. CVSS is only a tiebreaker.

Each bug then lands in one of four buckets: Act Now, Review, FYI, or Noise. Four things skip the grading and go straight to Act Now:

• being on KEV
• CISA requiring a forensic check for past break-ins
• CISA rating the bug actively exploited and automatable
• a highly reliable Metasploit tool for widely used software

A bug with a real threat, lots of users, and a cheap fix also gets bumped up as an “easy win.”

Where AI fits, and where it doesn’t

For the top bugs, an AI reads the vendor’s advisory to find out what the fix is and how disruptive it will be. It is not allowed to decide how serious a bug is; that stays with the math. Automatic checks then catch any made-up CVEs or version numbers. They also replace useless advice like “apply the patch” with real containment steps when no patch exists. Finally, a Quatronics analyst reviews and approves every issue before it’s sent.

What’s in your Monday email

The headline tells you how many items need action this week. Act Now entries explain what’s wrong, why it’s urgent, and exactly what to do.

“Exploit code exists, CISA has not rated it” is our early warning. The tools to attack these bugs are public, but CISA hasn’t caught up yet. That doesn’t prove anyone is attacking, but historically this is where future KEV entries come from. “We flagged these before CISA did” section shows early warnings that later landed on KEV, and how many days ahead we were.

The Don’t Panic section lists high-CVSS bugs we’re deliberately putting lower, each with a reason. An item counts as new if we first saw it this week, CISA added it to KEV this week, or it’s an Act Now item that hasn’t been sent before. An item is updated if its score changed after an earlier issue. The attached full report lists every assessed vulnerability with all its scores.

How to use it

1. Read the headline and summary first.
2. Compare the Act Now list against what you actually run. If you have it, fix it this week.
3. Scan the early warnings for anything facing the internet.
4. When someone forwards a scary “CVSS 9.8!” alert, check Don’t Panic for our reasoning.
5. Keep the full report as a searchable weekly record.

This brief is general intelligence, not advice tailored to your company. Your own list of systems decides what matters most to you.