An EPSS score answers a question CVSS was never designed to answer: not "how bad is this," but "how likely is this to actually get exploited soon."
What EPSS is
EPSS (Exploit Prediction Scoring System) is maintained by FIRST.org, the same organization that stewards CVSS. It's a machine-learning model trained on a large set of features per CVE — public exploit code availability, references in exploit databases and offensive security tooling, the popularity of the affected software, discussion in security research and social channels, and observed scanning and attack traffic across sensor networks.
The model is retrained and the scores for every published CVE are recalculated daily.
What an EPSS score represents
An EPSS score is a probability between 0.0 and 1.0, representing the model's estimate of the likelihood that a given CVE will be exploited in the wild within the next 30 days. An EPSS of 0.90 means the model estimates a 90% chance of exploitation activity in that window. An EPSS of 0.01 means roughly a 1% chance.
For calibration: the majority of published CVEs — by most published FIRST.org analyses, well over 90% — carry EPSS scores under 0.10. Most vulnerabilities, even ones that look severe on paper, are simply never exploited. EPSS exists to help you find the minority that will be.
Why EPSS differs from CVSS
CVSS is static and structural: it's computed once from the technical characteristics of the vulnerability (attack vector, privileges required, impact) and doesn't change based on what attackers actually do afterward. EPSS is dynamic and behavioral: it changes daily based on real-world signals, and it can move dramatically in either direction as conditions change — a CVE with EPSS 0.02 in January can jump to 0.85 in March if a reliable public exploit is published, or if it starts showing up in commodity attack frameworks.
The two scores are frequently uncorrelated. A CVSS 9.8 vulnerability can sit at EPSS 0.01 indefinitely if it's simply hard to exploit in practice or affects software nobody runs in an internet-facing configuration. A CVSS 6.5 vulnerability can carry an EPSS above 0.80 if it's trivial to exploit and widely automated. CVSS measures the vulnerability; EPSS measures attacker behavior around it.
How security teams can use EPSS
EPSS is most useful as a ranking signal across a large finding set, not as a binary gate. A practical approach:
- Sort non-KEV findings by EPSS as the primary axis, since it's the best continuously-updated forward-looking signal available for predicting what's likely to matter soon.
- Set a threshold for elevated attention, commonly somewhere around EPSS 0.10–0.20 depending on your risk tolerance — findings above that line warrant closer review even without a KEV entry yet.
- Re-score regularly. Because EPSS updates daily, a finding that looked low-priority last week can climb into the danger zone this week without anything on your side changing. A vulnerability management process that scores once at scan time and never revisits it will miss these transitions.
- Don't treat EPSS as certainty. It's a probability estimate from a statistical model, not a guarantee. Use it to prioritize attention, not as the sole justification for skipping a fix entirely.
Practical examples
A CVE with EPSS 0.97. This is close to the top of the observed distribution — the model is highly confident exploitation is imminent or already underway broadly. In practice, CVEs at this level are very often also in KEV by the time EPSS reaches this range, since real exploitation and the predictive signal tend to converge.
A CVE with EPSS 0.004. Statistically almost certain not to be exploited in the next 30 days based on everything the model can observe. This doesn't mean the vulnerability is safe to ignore forever — it means it isn't the thing that needs attention this week.
A CVE that moves from EPSS 0.03 to EPSS 0.65 over two weeks. This is the scenario EPSS exists to catch — a vulnerability that looked unremarkable at scan time and became a real threat as public exploit tooling or active scanning activity emerged. A static, scan-time-only prioritization process never sees this shift; a process that re-enriches findings on a schedule does.
Limitations
EPSS is a statistical model, and like any model it has real limits worth knowing before you lean on it too hard:
- It's a probability, not a fact. A high score means elevated likelihood, not certainty — and a low score doesn't guarantee safety, particularly for a vulnerability specific to your environment that the model's general training data wouldn't capture well.
- It reflects general internet-wide exploitation patterns, not your specific exposure. A CVE with low EPSS overall could still be highly relevant if it affects a system you have unusually exposed to the internet.
- New CVEs have thin data. EPSS scores for very recently published CVEs are less reliable than scores for CVEs with weeks or months of observed signal behind them.
- It says nothing about impact. EPSS estimates likelihood of exploitation, not what happens if exploitation succeeds — that's still CVSS's (or your own environmental risk assessment's) job.
How EPSS fits into vulnerability prioritization
EPSS is the middle signal between CVSS's static severity and KEV's confirmed-exploitation floor. It's the piece that lets you distinguish, among the hundreds of findings that aren't yet confirmed-exploited, which ones are actually trending toward becoming a problem versus which ones are likely to sit quietly forever. VulnPilot weights EPSS at 35 of the 100 points in its composite scoring model — the second-largest weight after KEV — specifically because it's the best available forward-looking signal for the large majority of findings that haven't (yet) made it onto the KEV catalog.
For the full picture of how EPSS, CVSS, and CISA KEV work together, see CVSS vs EPSS vs CISA KEV, or read about the confirmed-exploitation counterpart in what CISA KEV represents.