# Ep46: Vulnerability Prioritization: Why 98.5% of CVEs Are Never Exploited

Page: https://stenobird.com/podcast/byte-sized-security-6574623/ep46-vulnerability-prioritization-why-98-5-of-cves-are-never-exploited
Text version: https://stenobird.com/podcast/byte-sized-security-6574623/ep46-vulnerability-prioritization-why-98-5-of-cves-are-never-exploited.md
Podcast: [Byte Sized Security](https://stenobird.com/podcast/byte-sized-security-6574623)
Published: 2026-09-10T18:59:00+00:00
Episode link: https://bytesizedsecurity.show/episode/ep46-vulnerability-prioritization-why-98-5-of-cves-are-never-exploited
Audio file: https://pdcn.co/e/episodes.captivate.fm/episode/0d80418d-ac30-4432-a2c7-7ee6d5cd5df7.mp3
Processing state: not_requested
JSON: https://stenobird.com/v1/public/podcasts/byte-sized-security-6574623/episodes/ep46-vulnerability-prioritization-why-98-5-of-cves-are-never-exploited
Duration seconds: 577

## Resource

Roughly 98.5% of all known CVEs have never been exploited. We break down a conversation between Jeremiah Grossman and Robert Hansen of Root Evidence, hosted by Raphael Mudge on Down the Rabbit Hole, and what it means for how you prioritize a patch queue: CVSS score vs. exploitation evidence vs. insurance-claims data, CISA's free KEV catalog, and why the vulnerability management industry has no incentive to tell you the truth.

## Actions

- request_transcript: `POST https://stenobird.com/v1/public/podcasts/byte-sized-security-6574623/episodes/ep46-vulnerability-prioritization-why-98-5-of-cves-are-never-exploited/transcription-requests` — Idempotently request low-priority transcript generation for this episode.
- read_markdown: `GET https://stenobird.com/podcast/byte-sized-security-6574623/ep46-vulnerability-prioritization-why-98-5-of-cves-are-never-exploited.md` — Read the agent-friendly Markdown representation of this episode resource.

A page view does not enqueue transcription. Agents should invoke `request_transcript` explicitly when they need this episode processed.

## Transcript

Full transcripts are not published on public pages unless there is a clear rights basis.