EVENTS / webinar

From CVE Scores to Action: Enforcing Artifact Management Policies in OPA

Not every CVE is worth chasing. In this webinar, we’ll show how to combine CVSS severity with EPSS exploitability inside Open Policy Agent (OPA) to automatically quarantine the vulnerabilities that matter most.

  • Thu, Sep 25 · 3:00PM UTC

Things you'll learn

  • The limits of CVSS alone: why theoretical severity scores can create noise instead of clarity.
  • How EPSS adds context: using probability-based risk assessment to prioritize vulnerabilities that matter most.
  • Policy-as-Code with OPA: writing Rego rules that automatically block or tag vulnerable packages based on CVSS, EPSS, and exploit availability.
  • Real-world scenarios: examples of high-severity CVEs with low exploitability, and low-severity CVEs with high exploitation probability.
  • Cloudsmith’s approach: how continuous scanning, automated quarantine, and policy-driven enforcement accelerate DevSecOps workflows.

Speakers

Nigel Douglas
Nigel Douglas
Head of Developer RelationsCloudsmith

Summary

Vulnerability management isn’t about patching everything - it’s about patching what actually matters. CVSS gives you severity. EPSS gives you probability. Together, they let you prioritize risk in a way that reflects real-world exploitation, not just theoretical impact.

In this session, we’ll show how to integrate EPSS and CVSS into Open Policy Agent (OPA) to automatically quarantine packages that cross defined thresholds. Using Rego, you’ll learn how to encode risk-based policies that block high-severity, high-likelihood vulnerabilities before they hit production - without slowing down development workflows.