EPSS, the Exploit Prediction Scoring System, is a data-driven model that estimates the probability that a published CVE will be exploited in the wild within the next 30 days. In cybersecurity vulnerability management it answers a question that severity scores do not: not how bad a flaw would be if exploited, but how likely it is that attackers will actually use it soon.
EPSS is maintained by a special interest group of FIRST, the Forum of Incident Response and Security Teams, and publishes a fresh score for every known CVE once a day. Each score is a value between 0 and 1, accompanied by a percentile that ranks the vulnerability against all others, and the data is freely available for download and through a public API.
How EPSS produces its probability
EPSS is a machine learning model trained on observed exploitation. Its ground truth comes from partner organizations that record exploitation attempts through intrusion detection sensors, honeypots and other telemetry, and the model learns which characteristics of a vulnerability correlate with such activity appearing in the following 30 days.
Since version 2 the model has used gradient-boosted decision trees, and it is retrained periodically while scores are recalculated daily as new evidence appears. The main categories of input features are summarized below.
| Feature group | Examples | Why it predicts exploitation |
|---|---|---|
| Public exploit code | Exploit databases, Metasploit modules, code repositories | Lowers the effort for attackers |
| Vendor and product | Affected vendor, widely deployed products | Popular targets attract more activity |
| Vulnerability type | CWE category such as injection or RCE | Some classes are easier to weaponize |
| Age of the CVE | Days since publication | Activity patterns shift over time |
| References and mentions | Advisories, social media, security lists | Attention often precedes attacks |
| Scanner and list coverage | Detection templates, exploitation catalogs | Signals active interest and tooling |
Because the inputs change daily, an EPSS score is a moving estimate, not a fixed property. A score can jump sharply on the day a working exploit is published and drift down when interest fades.
Reading the score and the percentile
The probability is the primary output and can be used directly in risk calculations. The percentile states what share of all scored CVEs have an equal or lower probability, which is convenient for ranking but hides absolute risk. The distribution is heavily skewed: the large majority of CVEs receive probabilities of only a few percent or less, so even a modest probability can place a vulnerability in a high percentile.
| EPSS probability | Plain meaning | Typical handling |
|---|---|---|
| Below 0.01 | Under 1 percent chance in 30 days | Normal patch cycle |
| 0.01 to 0.1 | Low but not negligible | Prioritize on exposed or critical assets |
| 0.1 to 0.5 | Substantial likelihood | Expedited remediation |
| Above 0.5 | Exploitation more likely than not | Treat as urgent, check for compromise |
These bands are illustrative, not official thresholds. EPSS deliberately publishes no fixed cutoffs, because the right threshold depends on remediation capacity and on how much risk an organization accepts. Version differences matter as well: scores from different model versions are not directly comparable, so historical analysis should note which version produced each value.
EPSS compared with CVSS and CISA KEV
EPSS is designed to complement, not replace, the other common inputs to vulnerability prioritization. CVSS describes technical severity, the CISA KEV catalog confirms known exploitation, and EPSS forecasts likely exploitation. Each answers a different question.
| Signal | Question it answers | Nature of the output |
|---|---|---|
| CVSS base score | How severe is the flaw if exploited | Static rating from 0.0 to 10.0 |
| EPSS | How likely is exploitation in 30 days | Daily probability from 0 to 1 |
| CISA KEV | Has exploitation been confirmed | Curated yes-or-no list |
| Vendor advisory rating | How the vendor ranks the issue | Labels such as critical or important |
| Asset context | How exposed and valuable is the system | Internal inventory data |
A frequent finding in prioritization studies is that only a small fraction of published CVEs are ever exploited, while a large share carry high or critical CVSS ratings. Patching by CVSS alone therefore consumes effort on many flaws that attackers ignore, which is the efficiency gap EPSS was built to close.
Using EPSS in vulnerability management
In practice EPSS works best as one input in a combined decision. Teams typically treat anything in CISA KEV as urgent, then use EPSS to order the remaining backlog, and finally weigh asset exposure and business criticality. Many vulnerability scanners and risk platforms now import EPSS daily and display it next to CVSS.
| Situation | Recommended action | Reason |
|---|---|---|
| Listed in KEV | Remediate within days | Exploitation already confirmed |
| High EPSS, internet-facing asset | Expedite patching or mitigate | Likely attack plus direct exposure |
| High CVSS, very low EPSS, internal | Regular patch cycle | Severe but unlikely to be targeted soon |
| Low CVSS, rising EPSS | Monitor and reassess | Attention may precede weaponization |
Program owners can also use EPSS to measure coverage and efficiency: how many of the vulnerabilities that were later exploited were remediated in time, and how much effort went into vulnerabilities that never were. These two measures make the trade-off between thoroughness and workload explicit.
Limitations and common misreadings
- Only published CVEs are scored: zero-days, misconfigurations and flaws without a CVE identifier fall outside EPSS.
- Exploitation activity is not compromise: the ground truth records attempts observed by sensors, not successful breaches.
- No knowledge of the environment: EPSS does not know whether a system is exposed, mitigated or even present.
- Bias toward observable attacks: exploitation that sensors rarely see, such as targeted attacks on internal systems, may be underrepresented.
- A low score is not a guarantee: probabilities change daily, and a quiet vulnerability can become popular overnight.
The most common misreading is treating the percentile as a probability. A CVE in the 90th percentile may still have a probability of only a few percent, so decisions should rest on the probability itself together with asset context.
Stripped to the essentials
Thousands of software flaws are published every year, far more than any team can fix at once. A severity rating says how much damage a flaw could do, a bit like rating how dangerous a storm would be if it hit. EPSS is the weather forecast: it estimates how likely it is that attackers will actually use a given flaw in the coming month.
With that forecast, defenders can fix the flaws most likely to be attacked first, instead of chasing every scary-sounding one. It is a guide for ordering work, not a promise that the rest are safe.
Where it is applied
A regional hospital’s IT team faces a backlog of about 4,000 open vulnerability findings, around a third of them rated high or critical by CVSS. With a small team, patching everything rated critical within two weeks has proved impossible, and staff spend time on flaws that pose little real risk.
The team adopts a combined rule: KEV entries and internet-facing findings with an EPSS probability above 0.1 must be fixed within seven days, everything else follows the monthly cycle. The urgent list shrinks to a few dozen items that can be handled properly. When a proof-of-concept exploit appears for a VPN appliance flaw and its EPSS score climbs sharply, the daily import flags it the next morning and the appliance is patched before scanning traffic reaches it.