Use when a dependency, image or SBOM scan returned more CVEs than the team can fix and someone must decide what to fix first. Ranks each CVE by EPSS exploit probability and CISA KEV status, applies VEX and reachability, and sorts findings into Fix-Now, This-Sprint, Backlog or Accept-Risk.