- [ ] Exploit-DB/PoC availability check - [ ] Threat intel feed integration (MISP, OTX) - [ ] Ransomware association tagging - [ ] Actively exploited in wild confidence scoring Success: Prioritize CVEs with public exploits higher