200 CVEs, 3 that matter: signal vs noise under the CRA

Run a vulnerability scanner against any real codebase and it will hand you a wall of findings. Fifty, a hundred, two hundred CVEs. Most people's response is to feel vaguely doomed and close the tab. That reaction is rational , because as a list, it's useless.

Why raw CVE counts don't help

The vast majority of known vulnerabilities are never exploited in the wild. They're theoretical: a flaw exists, but no attacker has weaponised it, and many never will. A report that treats all 200 equally gives you no way to know where to start , so you start nowhere.

The Cyber Resilience Act is, helpfully, more precise than a raw scanner. Its 24-hour reporting obligation is triggered by actively exploited vulnerabilities , the ones attackers are actually using. Not every CVE. Not every dependabot alert. That narrowness is what makes the obligation survivable, and it's also the filter that turns the wall of noise into a short, actionable list.

The two filters that matter

• CISA KEV - the Known Exploited Vulnerabilities catalogue. A curated, public list of vulnerabilities confirmed to be exploited in the wild. If something you ship is on it, that's your priority , and it's the CRA's reporting trigger.
• EPSS - a probability score (from FIRST) estimating how likely a vulnerability is to be exploited soon. Useful for ranking the ones not yet on KEV.

Put those over your dependency list and 200 findings collapse to the three that deserve your attention this week. That's not a smaller version of the same report , it's a different, useful thing: a to-do list instead of a wall.

The lesson generalises beyond the CRA: a security report that doesn't rank by real-world exploitability isn't helping you, it's just transferring anxiety. Lead with what's exploited.