Cybersecurity glossary
What is the Exploit Prediction Scoring System (EPSS)?
Learn what EPSS is, how FIRST’s exploit probability scores complement CVSS, how to read percentiles, and how to use EPSS with KEV data for smarter patch priority.
Definition
The Exploit Prediction Scoring System (EPSS) is a data-driven scoring model from FIRST that estimates the probability a software vulnerability will be exploited in the wild within a defined near-term window, helping defenders prioritize remediation beyond severity alone.
Why severity alone fails prioritization
A CVSS 9.8 that nobody exploits this month can wait behind a CVSS 7.5 that ransomware gangs are scanning for today. The Exploit Prediction Scoring System (EPSS) exists to quantify that difference: it estimates the chance a given CVE will see exploitation soon.
EPSS does not replace judgment. It reduces backlog blindness when thousands of “high” findings compete for the same engineers.
How EPSS is used in practice
Ingest CVE findings from scanners
Normalize inventory hits to CVE IDs with asset and exposure metadata.
Join EPSS probability and percentile
Attach the latest EPSS values for each CVE from FIRST’s published data.
Blend with severity and exploitation evidence
Combine CVSS, CISA KEV, internet reachability, and crown-jewel tags.
Sequence remediation work
Raise tickets for high-likelihood, high-exposure items first; schedule the rest.
Refresh scores as threat data moves
Re-rank open items when EPSS jumps or a CVE enters KEV.
What EPSS measures well—and poorly
Near-term exploit likelihood
Useful for ranking which known CVEs are more likely to be attacked soon.
Not impact magnitude
A high EPSS CVE can still be low business impact on the wrong asset.
Not your environment
Scores are global; your segmentation and patch lag still decide exposure.
Not a guarantee
Low EPSS vulnerabilities still get exploited; treat probability as a signal.
Building a priority stack with EPSS
| Input | Role in priority |
|---|---|
| EPSS probability / percentile | Ranks near-term exploitation likelihood |
| CVSS Base / Environmental | Describes technical severity if abused |
| CISA KEV | Confirms observed exploitation warranting urgent action |
| Internet / partner exposure | Filters global scores to reachable assets |
| Asset criticality | Weights business blast radius |
- Automate daily EPSS joins onto open CVE tickets—not quarterly spreadsheet pulls.
- Alert when EPSS percentiles spike for assets you already know are exposed.
- Never drop CVSS Critical items solely because EPSS is low without documenting risk.
- Treat KEV membership as a hard escalate regardless of yesterday’s EPSS.
- Show engineers both probability and percentile to avoid misreading tiny decimals.
- Revisit accepted risks when EPSS or exploit maturity changes.
- Use EPSS to defend patch order in change boards with evidence, not vibes.
- Keep humans in the loop for novel threat campaigns the model has not reflected yet.
The practical takeaway
EPSS answers “how likely is exploitation soon?” while CVSS answers “how bad could it be?” Prioritize with both, plus exposure and KEV.
If your backlog is sorted only by CVSS, you are optimizing for severity theater—not attacker calendars.
Related security terms
Common Vulnerabilities and Exposures (CVE)
Public vulnerability IDs that EPSS scores are computed against.
Common Vulnerability Scoring System (CVSS)
Severity framework that EPSS complements rather than replaces.
Exploitability
Broader concept of how easily a flaw can be abused in practice.
Proof of Concept (PoC)
Public exploit demos that can correlate with rising EPSS signals.
Remediation
The patching and fixing work EPSS helps sequence.
Frequently asked questions
What is EPSS in simple terms?
EPSS estimates how likely a known CVE is to be exploited soon, based on observed threat data—not how bad the impact would be if exploited.
Who publishes EPSS?
FIRST maintains EPSS and publishes regularly updated scores for CVE IDs.
How is EPSS different from CVSS?
CVSS describes technical severity. EPSS estimates near-term exploitation probability. A high-severity bug can have a low EPSS, and vice versa.
What is an EPSS percentile?
It ranks a CVE relative to other scored vulnerabilities—for example, the 95th percentile means higher predicted exploitation likelihood than most CVEs.
Should I only patch high-EPSS CVEs?
No. Combine EPSS with asset exposure, KEV listings, business criticality, and CVSS. Critical internet-facing systems may still need low-EPSS fixes quickly.
Does EPSS predict zero-days?
No. EPSS focuses on known CVE identifiers using features derived from public and telemetry-informed signals.
How often do EPSS scores change?
Scores are refreshed on an ongoing schedule as new threat observations arrive, so yesterday’s ranking can shift.
References
Explore authoritative guidance and frameworks related to exploit prediction scoring system (epss).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.