What Is the Exploit Prediction Scoring System (EPSS)?

The Exploit Prediction Scoring System (EPSS) is a data-driven framework that estimates the probability that a known vulnerability will be exploited in the wild within the next 30 days. Where CVSS measures how severe a vulnerability is, EPSS measures how likely it is to actually be exploited. A vulnerability with an EPSS score of 0.94 has a 94% predicted probability of exploitation in the real world within that window. A vulnerability with a score of 0.003 has less than a 1% predicted probability.

The distinction matters more than it might initially appear. Security teams managing vulnerability backlogs face a consistent structural problem: there are always more open findings than remediation capacity. CVSS severity scores identify which vulnerabilities are theoretically dangerous. EPSS identifies which ones are actively being weaponized by threat actors right now. Using both together produces a prioritization model that reflects both the potential impact of a vulnerability and the real-world probability that it will be used against you.

This post covers how EPSS works, how its scores are calculated, what the score ranges mean operationally, how EPSS compares to and complements CVSS, and how security teams apply EPSS in practice.

Key Takeaways

• EPSS scores express the probability (0 to 1, equivalent to 0% to 100%) that a CVE will be exploited in the wild within 30 days
• EPSS is maintained by FIRST and uses machine learning trained on CVE characteristics, exploit availability, threat intelligence feeds, and observed real-world exploitation data
• Only approximately 5% of all published CVEs are ever exploited in the wild; EPSS helps identify which ones are at risk
• EPSS and CVSS answer different questions: CVSS measures severity if exploited; EPSS measures likelihood of exploitation; effective prioritization uses both
• EPSS scores are updated daily as new threat signals are ingested, making them a live indicator rather than a static severity label

What Is EPSS and Who Maintains It?

EPSS is maintained by FIRST, the Forum of Incident Response and Security Teams, the same organization that maintains CVSS. FIRST launched EPSS v1 in 2021, released EPSS v2 in 2022, and published EPSS v3 in March 2023. EPSS v3 represented a significant improvement in predictive accuracy over earlier versions, powered by a larger training dataset and a refined machine learning methodology.

EPSS was created to address a gap that CVSS alone cannot fill. CVSS scores a vulnerability based on its intrinsic technical properties: how it is exploited, what privileges are required, and what the impact is on confidentiality, integrity, and availability. These properties are fixed at the time of disclosure and do not change as the threat landscape evolves. A vulnerability that scores 9.8 on CVSS retains that score regardless of whether working exploit code has been published, whether ransomware groups are actively using it, or whether it has never been exploited in a real-world attack.

EPSS addresses the temporal dimension that CVSS omits. Its scores change daily as new threat signals are ingested. A CVE that scored 0.04 one month can spike to 0.78 after a public proof-of-concept is published and security researchers begin analyzing it. This live quality makes EPSS a different kind of tool from CVSS: not a permanent severity classification but a current threat signal.

EPSS scores are publicly available for every CVE through the FIRST API and are increasingly integrated into vulnerability scanners, SIEM platforms, and vulnerability management programs as a standard input for risk-adjusted prioritization.

How Is the EPSS Score Calculated?

EPSS uses a machine learning model trained on a large dataset of CVE characteristics and real-world exploitation signals. The model produces a probability estimate for each CVE in the NVD. Scores are recalculated and published daily.

CVE characteristics feed into the model as baseline inputs. These include the CVE’s age, the affected software type, the vendor, the product category, and CVSS metric values such as attack vector and attack complexity. CVEs affecting network-reachable components with low complexity tend to score higher than those requiring physical access or specific conditions.

Proof-of-concept exploit availability is one of the strongest predictive signals. When working exploit code is published on GitHub, Exploit-DB, or referenced in public security research, the probability of real-world exploitation rises sharply. The model tracks exploit publication events and adjusts scores accordingly.

Security community activity contributes signals through mentions in social media, security conference presentations, and researcher blog posts. A CVE that attracts significant attention in the security research community tends to have a higher exploitation probability than one that passes without comment.

Observed exploitation data from threat intelligence feeds, honeypot networks, and incident reports provides ground truth for model calibration. When a CVE is observed being exploited across multiple sources, this direct signal propagates into updated EPSS scores for that CVE and influences predictions for related vulnerabilities.

The output of this model is a single probability value between 0 and 1. Bugstrix vulnerability assessment engagements incorporate EPSS scores alongside CVSS ratings for every finding, giving clients both a severity baseline and a current exploitation likelihood signal to inform vulnerability assessment and remediation planning.

What Do EPSS Scores Mean in Practice?

EPSS scores are expressed as probabilities. A score of 0.94 means the model predicts a 94% chance the vulnerability will be observed being exploited in the wild within 30 days. A score of 0.02 means a 2% chance. The scores are not uniformly distributed: the vast majority of CVEs have very low EPSS scores, with a small subset carrying high exploitation probability.

An important data point about EPSS distribution: research consistently shows that fewer than 5% of published CVEs are ever observed being exploited in the wild. Most CVEs have EPSS scores below 0.01. This skewed distribution is exactly why EPSS is useful: it separates the small subset of CVEs that carry real exploitation risk from the large majority that will never be weaponized in practice.

Zero-day vulnerabilities present a special case. By definition, a zero-day has no CVE at the time of exploitation, so EPSS cannot score it until after it is disclosed. Once a zero-day is published and assigned a CVE, its EPSS score typically spikes rapidly because the conditions that make a vulnerability exploitable are already demonstrated by the fact that it was discovered through active exploitation.

How Does EPSS Differ From CVSS?

CVSS and EPSS are complementary frameworks that measure different properties of the same vulnerability. They are not alternatives; they answer different questions.

CVSS measures severity. Given that this vulnerability is exploited, how bad will the outcome be? CVSS captures this through metrics like attack vector, attack complexity, and impact on confidentiality, integrity, and availability. A 9.8 CVSS score means that if an attacker successfully exploits this vulnerability, the consequences are catastrophic. CVSS says nothing about whether anyone is actually trying to exploit it.

EPSS measures exploitation likelihood. What is the probability that this vulnerability will be actively exploited in the real world within the next 30 days? EPSS captures this through machine learning over threat intelligence data. A 0.95 EPSS score means exploitation is highly probable right now. EPSS says nothing about how severe that exploitation will be.

The practical implication is that high CVSS and high EPSS do not always coincide. A vulnerability can score 9.5 on CVSS and 0.002 on EPSS, meaning it is catastrophic if exploited but almost never exploited in practice. Another can score 5.3 on CVSS and 0.88 on EPSS, meaning it is a moderate-severity flaw that is being actively exploited across the internet right now.

Understanding what CVSS is and how it is calculated is a prerequisite for using EPSS effectively. CVSS provides the severity baseline; EPSS adds the exploitation probability layer. Teams that work with both develop a richer picture of vulnerability risk than teams that rely on CVSS severity alone.

How Do EPSS and CVSS Work Together for Prioritization?

The most effective use of EPSS is in combination with CVSS, asset criticality data, and external exposure context. Each dimension answers a different question, and all three are needed for risk-adjusted prioritization.

High CVSS + High EPSS is the unambiguous top priority: severe impact if exploited and high probability of exploitation. These findings require immediate action regardless of other factors. Every high-CVSS, high-EPSS vulnerability on an internet-facing system is an active threat.

High CVSS + Low EPSS describes a theoretically dangerous vulnerability that is not currently being weaponized. This is where CVSS-only prioritization creates bloated remediation queues: teams spend resources patching high-severity findings that carry negligible real-world exploitation probability while higher-EPSS findings in the medium-severity range wait. Risk-adjusted prioritization deprioritizes these findings relative to their CVSS rank until exploitation signals emerge.

Low CVSS + High EPSS is the failure mode that CVSS-only programs miss entirely. A moderate-severity vulnerability being actively exploited across the internet is more urgent than a critical-severity vulnerability that no one is using. EPSS surfaces these findings. Ignoring them because their CVSS score does not trigger the emergency response threshold is the kind of gap that leads to incidents from vulnerabilities that scanners flagged as Medium.

Low CVSS + Low EPSS describes the majority of the CVE catalog: theoretically exploitable, rarely if ever exploited in practice, low impact if it were. These findings are tracked and remediated in maintenance cycles without consuming priority queue resources.

Combining this framework with attack surface management data completes the picture. An asset’s external exposure determines which CVEs on it actually represent a network-accessible attack path. A high-EPSS vulnerability on an air-gapped internal system has different practical urgency than the same CVE on a public-facing web application. Attack surface context is the final layer that turns a CVSS-plus-EPSS score into a prioritized remediation order.

How Is EPSS Used in Vulnerability Management and Security Testing?

EPSS integrates into security programs at multiple levels, from the tactical decisions in individual assessments to the strategic design of continuous monitoring programs.

In penetration testing, EPSS scores provide context for how quickly findings need to be remediated. Bugstrix penetration testing reports include EPSS scores alongside CVSS ratings for vulnerabilities tied to known CVEs, and security engineers use current EPSS data to flag which findings are being actively exploited in the wild at the time of the engagement. A finding that corresponds to a CVE with a 0.93 EPSS score carries different urgency than one with a 0.008 score, even if their CVSS values are similar.

In continuous vulnerability management, EPSS scores feed directly into prioritization queues. Automated tools ingest daily EPSS updates and resurface findings that have risen in exploitation probability since they were first identified. A vulnerability that was deprioritized three months ago because its EPSS score was 0.02 may reappear as urgent if its score spikes to 0.74 after a public exploit is released. Continuous Threat Exposure Management (CTEM) frameworks are built on exactly this kind of dynamic, signal-driven prioritization. EPSS is one of the primary threat signals that drives CTEM workflows, alongside threat actor TTP data and asset exposure mapping.

In security operations, EPSS thresholds can trigger automated response workflows. A CVE whose EPSS score crosses a defined threshold can automatically generate a remediation ticket, trigger a detection rule update, or escalate a previously deferred finding to active remediation status. This automation reduces the lag between a vulnerability becoming actively exploited and a security team becoming aware that their prioritization needs to change.

Get a quote for a penetration testing or vulnerability assessment engagement

What Are the Limitations of EPSS?

EPSS is a powerful prioritization signal, but it has constraints that security teams need to understand to use it correctly.

EPSS only covers CVEs. Custom application vulnerabilities, business logic flaws, misconfigurations, and weaknesses in internal code that have never been assigned a CVE identifier fall completely outside EPSS’s scope. A logic flaw in a custom API that allows unauthorized data access will never have an EPSS score because it is not a published CVE. This is the core reason why penetration testing remains essential alongside EPSS-driven vulnerability management: manual testing surfaces the class of vulnerabilities that no scoring framework can assess.

EPSS predicts industry-wide exploitation, not organization-specific targeting. A high EPSS score means the vulnerability is being exploited somewhere in the world across multiple organizations. It does not mean your organization is being targeted. An organization in an industry sector that is not a target for the threat actors currently exploiting a particular CVE may face lower practical risk than the EPSS score implies. Conversely, an organization that is a high-value target for sophisticated actors may face elevated risk from low-EPSS CVEs being used in targeted campaigns.

Low EPSS does not mean safe. An EPSS score of 0.008 means low predicted exploitation probability industry-wide, not zero. Nation-state actors, targeted campaigns, and narrow exploitation against specific vendor ecosystems can produce real-world exploitation that a broad probability model does not fully capture. Understanding the difference between vulnerability assessment and penetration testing clarifies why automated scoring signals need to be supplemented by expert judgment about which asset classes and threat actors are most relevant to a specific organization.

EPSS scores change daily. This is a strength for staying current, but it means a snapshot from last month may no longer reflect the threat landscape today. EPSS-based prioritization requires live data integration, not periodic exports. Security programs that pull EPSS scores monthly and use them as static labels miss the dynamic behavior that makes EPSS valuable.

Frequently Asked Questions

Where can I access EPSS scores?

EPSS scores are freely available through the FIRST API at epss.cyentia.com. The API provides daily score updates for every CVE in the NVD. Many commercial vulnerability management platforms, scanners, and SIEM tools have integrated EPSS data feeds, so security teams often access EPSS scores through tools they already use rather than querying the API directly.

How accurate is EPSS at predicting exploitation?

EPSS v3 achieves meaningful predictive accuracy: vulnerabilities with EPSS scores above 0.10 are exploited at significantly higher rates than those below that threshold. The model is not perfect, and false positives (high-EPSS CVEs that are not exploited) and false negatives (low-EPSS CVEs that are exploited) both occur. EPSS is designed to improve prioritization efficiency across a large portfolio of findings, not to provide a guarantee about any individual CVE.

Should I replace CVSS with EPSS?

No. CVSS and EPSS are complementary, not interchangeable. CVSS measures severity if exploited; EPSS measures likelihood of exploitation. Removing CVSS from your prioritization model would mean ignoring impact severity. Removing EPSS would mean ignoring real-world exploitation probability. Effective prioritization uses both together, alongside asset criticality and exposure context.

How often do EPSS scores change significantly?

Most EPSS scores are relatively stable day to day, but significant changes occur at predictable moments: when a public proof-of-concept exploit is published, when a vulnerability is mentioned in a major security conference presentation, when ransomware groups begin actively using a CVE, or when a patch is released and attackers accelerate exploitation before organizations apply it. Score monitoring is most valuable around these events.

Does EPSS apply to zero-day vulnerabilities?

EPSS can only score CVEs that have been published and assigned an identifier. Zero-day vulnerabilities, which by definition are unknown to the vendor and have no CVE at the time of exploitation, cannot be scored by EPSS. Once a zero-day is disclosed and assigned a CVE, EPSS typically scores it quickly and often assigns a high probability if the vulnerability was already being actively exploited before disclosure.

What EPSS score threshold should trigger immediate action?

There is no universal threshold, but a common operational standard treats EPSS scores above 0.50 as requiring prioritized attention regardless of CVSS score, and scores above 0.90 as requiring the same response cadence as Critical CVSS findings. The right threshold depends on an organization’s risk tolerance, remediation capacity, and the criticality of the affected assets. The threshold should be paired with CVSS severity to produce a combined prioritization matrix rather than applied in isolation.

EPSS and the Move Toward Risk-Based Prioritization

EPSS represents a maturing of how the security industry thinks about vulnerability prioritization. The insight that only a small fraction of published CVEs are ever exploited is not new, but EPSS is the first widely adopted framework that operationalizes that insight at scale.

Security teams that adopt EPSS alongside CVSS stop treating a large backlog of high-severity findings as a uniform remediation queue and start treating it as a risk-differentiated portfolio. Most of what is in that queue carries low exploitation probability. A small subset carries high exploitation probability and needs to move to the front regardless of its CVSS ranking.

Bugstrix works with organizations to build vulnerability management programs that use EPSS correctly: integrated with CVSS severity, filtered through asset criticality and exposure data, and updated continuously so that prioritization reflects the current threat landscape rather than a static severity ranking from three months ago. The result is a program that spends remediation capacity where it matters and can demonstrate to stakeholders exactly why each prioritization decision was made.

Contact us to discuss your vulnerability management and prioritization program