CVSS vs EPSS vs CISA KEV: how to prioritize vulnerabilities

The short version: CVSS answers "how bad could this be?", EPSS answers "how likely is exploitation soon?", KEV answers "is it being exploited now?" Fix KEV-listed vulnerabilities first, use EPSS to o