Inspiration
Security teams face a constant stream of new vulnerabilities. We wanted to help them decide what to patch first by looking at exploitation likelihood, not severity alone.
What it does
Before the Breach ranks 2026 CVEs and produces a shortlist of 500 for security teams to review. It combines EPSS with public exploit evidence and a small adjustment based on historical exploitation rates for each weakness type.
How we built it
We built a Python and pandas pipeline using the supplied benchmark data: dated EPSS scores, public exploit signals, CVE weakness types, and CISA’s Known Exploited Vulnerabilities catalog. We tuned the ranking on 2024 data, then held the weights fixed to evaluate it on 2025 data. We excluded fields such as NVD status, last-modified dates, reference counts, affected-product counts, and missing CVSS scores to reduce hindsight leakage.
A separate IBM watsonx.ai Granite explanation step is prepared, but has not been run; the current ranking does not depend on it.
Challenges we ran into
Exploitation is rare, so the historical data contains relatively few positive examples. We also found an incomplete February 2025 signal file and NVD weakness labels that may have been updated after publication. We documented these limitations and used a time-based holdout to reduce the risk of overstating performance.
Accomplishments that we're proud of
On the 2025 holdout, our ranking put 19 of 48 later-added KEVs in its top 500, compared with 17 for public-exploit-first and 8 for EPSS-only. The final 2026 shortlist has 500 unique CVE IDs in the required format.
What we learned
Public exploit evidence can improve prioritization, but it is sparse. Time-aware validation and careful feature selection matter: a strong-looking score can be misleading if it uses information added after an attack.
What's next for BRICS
Run the Granite explanation step through watsonx.ai once access is configured, then add evidence-grounded explanations to make the shortlist easier to act on. We’d also like to test the approach on more future data and get feedback from security teams.
