Exploit Prediction Scoring System (EPSS)

The Exploit Prediction Scoring System (EPSS) is a data-driven model, maintained by FIRST, that estimates the probability a given vulnerability will be exploited in the wild within the next 30 days. Unlike CVSS, which describes theoretical technical severity based on the characteristics of the flaw itself, EPSS is a forward-looking prediction built from real-world data, including observed exploitation activity, vulnerability characteristics, and signals like public exploit code availability and mentions in security research and social media.

EPSS produces a score between 0 and 1, representing an estimated probability of exploitation, along with a percentile ranking that shows how a given vulnerability compares to all other scored vulnerabilities. A CVE with an EPSS score of 0.60 is estimated to have roughly a 60 percent chance of being exploited in the next month, which is a fundamentally different and often more actionable piece of information than a CVSS severity rating, since it speaks directly to likelihood of attack rather than potential impact if attacked.

The model behind EPSS is retrained regularly using a machine learning approach on a continuously updated dataset, which means scores can shift meaningfully over time as new exploitation evidence emerges or as proof-of-concept exploit code becomes publicly available. A vulnerability with a low EPSS score today can jump sharply if a working exploit is published or if researchers observe the first confirmed attacks using it, which is one more reason exposure management needs continuous re-evaluation rather than a one-time prioritization pass.

EPSS is most powerful when combined with other signals rather than used in isolation. A common and effective prioritization approach layers three inputs: CVSS for technical severity, EPSS for exploitation probability, and the CISA KEV catalog for confirmed exploitation, alongside business context about whether the affected asset is internet-facing and how critical it is. A finding with a high EPSS score, internet-facing exposure and appearance in KEV represents about as strong a signal for urgent remediation as currently exists in public vulnerability data.

Because most organizations have far more open vulnerabilities than they can realistically patch in any given cycle, EPSS is particularly valuable for triage at scale: it lets a security team confidently deprioritize the very long tail of technically valid but practically low-risk vulnerabilities, freeing capacity to focus on the smaller number that are both severe and genuinely likely to be attacked.