What is Exploit Prediction Scoring System (EPSS)?
The Exploit Prediction Scoring System maintained by FIRST is a data-driven machine-learning model that estimates the probability that a published Common Vulnerabilities and Exposures (CVE) record will be exploited in the wild within the next 30 days. The EPSS exploit probability score is published daily on a 0–1 scale, with a percentile, using observed exploitation and other threat signals.
EPSS measures exploitation likelihood, not technical severity. The Common Vulnerability Scoring System (CVSS) describes vulnerability characteristics and potential impact, while EPSS forecasts near-term exploitation probability. A high CVSS score can accompany a low EPSS score, or the reverse. Neither score establishes certainty or captures an organization’s exposure, asset criticality, controls, or business consequences.
What is Exploit Prediction Scoring System (EPSS) used for?
Security teams use EPSS to triage large vulnerability backlogs and direct limited remediation capacity toward CVEs more likely to face exploitation. It can inform patch sequencing, vulnerability-management service levels, exception review, and communication between security operations, infrastructure teams, application owners, and risk leaders.
EPSS should be combined with CVSS, known-exploitation evidence, asset importance, internet exposure, available mitigations, exploit availability, and current threat intelligence. Because the model updates daily and depends on observable data, teams should monitor score changes and test thresholds against their environment. EPSS is one prioritization input, not a complete remediation decision or a guarantee that exploitation will or will not occur.
