EPSS与风险评分策略治理（权重-阻断-灰度）最佳实践

实现示例type Advisory = { cve: string; cvss: number; epss: number } type Policy = { wCvss: number; wEpss: number; block: number; warn: number } function validCvss(s: number): boolean { return s >= 0 && s <= 10 && Number.isFinite(s) } function validEpss(p: number): boolean { return p >= 0 && p <= 1 && Number.isFinite(p) } function score(a: Advisory, p: Policy): number { return a.cvss * p.wCvss + a.epss * 10 * p.wEpss } function evaluate(list: Advisory[], p: Policy): { blocked: Advisory[]; warned: Advisory[]; passed: Advisory[] } { const blocked: Advisory[] = [] const warned: Advisory[] = [] const passed: Advisory[] = [] for (const a of list) { if (!validCvss(a.cvss) || !validEpss(a.epss)) { blocked.push(a); continue } const s = score(a, p) if (s >= p.block) blocked.push(a) else if (s >= p.warn) warned.push(a) else passed.push(a) } return { blocked, warned, passed } } 审计与CI门禁记录风险分与决策；阻断项直接失败；警告项进入灰度窗口处置。权重与阈值变更需审批并回归验证。