Integrating EPSS and CVSS in Open Policy Agent To Quarantine Real-world Vulnerabilities
summary
Shows how EPSS and CVSS get ingested as JSON into Open Policy Agent and used to auto-quarantine artifacts in Cloudsmith using Rego policies and Trivy scans. Demonstrates four CVEs where high CVSS but low EPSS changes prioritization, and examples where EPSS updates daily flagged exploits before NVD published CVEs. Policies check fix availability, exposure, known‑exploit feeds and regexed package names, produce decision logs, and successfully quarantine blocks image pulls to prevent deployment.
AI-written summary · about
chapters (12)
- 0:00EPSS CVSS OPA intro
- 3:31CVSS and EPSS scoring
- 7:27EPSS complements CVSS
- 11:41EPSS score use cases
- 17:19Inefficient vulnerability workflows
- 19:47OPA policy examples
- 25:23Quarantine packages in Cloudsmith
- 28:56OPA decision logs
- 31:26Continuous scanning integration
- 33:32Policy as code security
- 36:44Malware package policies
- 37:48OPA resources support
related talks
40mHow EPSS Is Wrong and Useful at the Same Time
58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization Standards
01h 23mEPSS: Challenges and Opportunities Going Forward + EPSS AMA
58mState of EPSS and What to Expect from Version 4
51mWhen it Comes to Managing Risk, Context is King
35mVulnrichment Playground
27mModeling Asset Risk Using Grouped EPSS
40mCVSS Scores Are Dead. Let’s Explore 4 Alternatives