A CVE triage pipeline that keeps asking, because day one tells you nothing (34-118-125-101.sslip.io)

The newly announced Rappaport CVE triage pipeline brings a novel approach to vulnerability management by emphasizing the need for ongoing re-evaluation of newly published CVEs rather than relying solely on initial severity assessments. By prioritizing decision-making via deterministic coding rather than automated language models, Rappaport seeks to mitigate the risks of premature conclusions drawn from limited data. The pipeline functions using clear parameters, incorporating signals like the CISA's Known Exploited Vulnerabilities catalogue and the Exploit Prediction Scoring System (EPSS), ultimately promoting effective vulnerability triage based on the probability of exploitation rather than CVSS scores. This approach is significant for the AI/ML community as it challenges traditional reliance on severity scores, presenting a systematic framework that acknowledges the dynamic nature of threat landscapes. The open-source foundation of Rappaport invites scrutiny and collaboration, encouraging the development of more robust triage solutions within cybersecurity. With a focus on transparency and accountability, it minimizes the language model's authority in prioritization and ensures that human oversight remains central to the decision-making process, addressing the challenge of inherent biases and limitations in machine-led evaluations.