What is EPSS? The Exploit Prediction Scoring System, defined for patch triage

The Exploit Prediction Scoring System (EPSS) is a data-driven model, maintained by a special interest group at FIRST, that estimates the probability that a published CVE will be exploited in the wild in the next 30 days. Scores run from 0 to 1, are published free every day, and help patch teams rank vulnerabilities that are not yet confirmed as exploited.

How to read a score and a percentile

The score is a probability. FIRST's EPSS FAQ explains that 0.05 means an estimated 5 percent chance of observed exploitation activity within 30 days. The percentile ranks a CVE against every scored vulnerability, so the 90th percentile means a higher score than 90 percent of them. New scores appear each day shortly after 13:30 UTC.

Exploitation has a specific meaning here. FIRST describes the estimate as the likelihood that one of its data partners' sensors will detect, record and share evidence of exploitation activity. A low score means little such activity is expected, not that exploitation is impossible.

What EPSS is not

EPSS does not measure damage, and it does not know your environment. FIRST says the model ignores compensating controls and anything specific to one organization. It is also not a severity score to blend with CVSS: FIRST warns that multiplying EPSS by a CVSS score does not produce probability times severity.

EPSS also differs from the KEV catalog. KEV lists vulnerabilities for which CISA has reliable evidence of active exploitation; EPSS forecasts exploitation that may or may not come. Once a CVE is on KEV, the forecast matters less than the confirmation.

What a patch desk does with it

Treat KEV entries as already decided, then use EPSS to order what remains. A workable routine: pull the daily scores, flag CVEs in your own inventory whose percentile jumped since the previous file, and review those before the next change window. Then add asset exposure, because EPSS cannot see it.

A score is a snapshot of one day's model output. FIRST republishes every score daily, so a threshold checked once at triage and never again will miss CVEs whose scores rise after the ticket was filed.

Where it appears on Daily CISO

Must-patch prints FIRST's EPSS score beside each KEV addition from the trailing 45 days. The security glossary sets EPSS beside CVSS and KEV, and exploit lag shows how long recent KEV additions stayed public before CISA confirmed exploitation.

Related terms

Common Vulnerability Scoring System (CVSS), Known Exploited Vulnerabilities (KEV) catalog, Common Vulnerabilities and Exposures (CVE) and exploit lag.