What is EPSS (Exploit Prediction Scoring System)?
Updated
The Exploit Prediction Scoring System (EPSS) is a data-driven model, maintained by a special interest group under FIRST.org, that estimates the probability a given vulnerability will be exploited in the wild within the next 30 days. Each CVE receives a score between 0 and 1 — effectively a percentage likelihood — that is refreshed as new data arrives.
EPSS exists to solve a prioritization problem: severity scores tell you how bad a flaw could be, but most high-severity flaws are never actually exploited. By predicting likelihood rather than impact, EPSS helps teams focus finite remediation effort on the vulnerabilities most likely to be used against them.
How EPSS works and how to read the score
EPSS is a statistical model trained on real-world exploitation data and a large set of vulnerability characteristics — references to exploit code, vendor and product, age, and signals observed in the wild. It outputs a probability, so an EPSS of 0.10 means the model estimates roughly a ten-percent chance the vulnerability will be exploited in the next thirty days. Scores are relative and shift over time as evidence changes.
A key property is that high EPSS scores are rare: most vulnerabilities score very low because most are never exploited. That skew is the point — it lets a team draw a threshold and reduce a backlog of thousands to a working list of dozens. EPSS is best treated as a ranking signal, not an absolute verdict, and read alongside whether the flaw actually reaches your assets.
Using EPSS with CVSS and KEV
The three common vulnerability signals are complementary. CVSS scores intrinsic severity; EPSS predicts near-term exploitation likelihood; the CISA KEV catalog confirms exploitation that is already happening. A defensible remediation order is to fix KEV entries first, then high-EPSS vulnerabilities, weighting by CVSS severity and by whether the affected component is actually exposed.
Relying on any one signal alone produces a poor queue. Sorting by CVSS floods the top of the list with severe-but-unexploited flaws; sorting by EPSS alone can under-weight a catastrophic-impact vulnerability that is only moderately likely. Combining them — likelihood, impact, and confirmed activity — is what turns raw scanner output into an actionable plan.
Frequently asked questions
What does an EPSS score mean?
It is the model's estimated probability, between 0 and 1, that a vulnerability will be exploited in the wild within the next 30 days. A score of 0.10 is roughly a ten-percent likelihood. Because most vulnerabilities are never exploited, the vast majority score very low, which is what makes a high score a useful priority signal.
Is EPSS a replacement for CVSS?
No — they measure different things. CVSS rates how severe a vulnerability would be if exploited; EPSS predicts how likely exploitation is soon. Used together, they prioritize far better than either alone: EPSS narrows the list to likely-exploited flaws and CVSS weights that list by potential impact.
How does EPSS relate to the CISA KEV catalog?
EPSS predicts future exploitation probability, while KEV records vulnerabilities under confirmed active exploitation now. KEV is the strongest signal when a CVE is on it; EPSS extends prioritization to the far larger set of vulnerabilities not yet on KEV by estimating which are most likely to be exploited next.
Published by ShipReady Metrics, an evidence-based technology and compliance intelligence platform. This guide is educational and vendor-neutral.