What is EPSS?
The EPSS (Exploit Prediction Scoring System) estimates, on a scale from 0 to 1, the probability that a vulnerability will be exploited in the next 30 days. Maintained by FIRST and recalculated every day, it answers not “is it serious?” but “is it likely?”.
Your scanner reports 400 vulnerabilities, 60 of them rated critical. You already know you won't fix 60 this week. EPSS exists to tell you which of them really deserve your Tuesday.
What exactly does 0.92 mean?
An EPSS of 0.92 means the model puts at 92 % the probability that exploitation activity will be observed against this flaw in the next 30 days. Not that it will be exploited in your environment. Not that it is severe. It is a statistical bet, placed again every morning based on what the world did with this flaw the day before.
Two images, because a single one always leads to a misreading. EPSS is like a chance-of-rain forecast: you don't argue with an 80% chance of rain, you take an umbrella, and it may very well not rain. It is also like bookmaker's odds: they factor in what just happened, they move every day, and they tell you something about the field, never about your own race.
Score and percentile: the confusion to avoid
EPSS publishes two numbers for each CVE, and people constantly mix them up:
- the score — the absolute probability. 0.40 means a 40% chance.
- the percentile — the relative rank among all CVEs. A percentile of 0.98 means: “98% of CVEs have a lower score than this one.”
Because the vast majority of flaws have a near-zero score, a modest score often corresponds to a very high percentile. A score of 0,40 puts a CVE near the top of the ranking, even though “40%” sounds like a middling figure. Set your thresholds on the score if you think in terms of probability, on the percentile if you think in terms of remediation budget.
What the distribution looks like
Here is what nobody shows, and it changes everything: the EPSS distribution is extremely skewed. Orders of magnitude taken from the distribution published by FIRST:
| EPSS score | Share of CVEs | Relative weight |
|---|---|---|
| Below 0.01 | about 80% | |
| 0.01 to 0.10 | about 14% | |
| 0.10 to 0.50 | about 5% | |
| Above 0.50 | about 1% |
FIRST publishes the exact daily distribution at first.org/epss/data_stats; it moves, and it is the reference. What to take away from its shape: a 0.10 cutoff filters out about 94 CVEs in 100. No other signal filters this hard for so little effort.
Why it beats sorting by severity
FIRST publishes a comparison that should be posted in every security team's room. At equal coverage — that is, catching the same share of flaws that actually get exploited — the two triage strategies require very different amounts of effort:
| Triage strategy | Effort (share of CVEs to fix) | Coverage (exploited flaws caught) |
|---|---|---|
| Everything with CVSS ≥ 7 | about 58% | about 82% |
| Everything with EPSS ≥ 0.088 | about 7% | about 82% |
Same result, eight times less work. That is the core argument for EPSS, and the numbers come from the organization that publishes the model — not from a software vendor.
How the score is calculated
EPSS is based on a machine learning model fed with public signals: whether a proof of concept exists, whether exploit code is included in offensive toolkits, mentions in public sources, the vendor involved, the weakness type (CWE), the CVE's age, and exploitation activity actually observed by partners' sensors.
Because these signals change, a CVE's score changes over time. A flaw that stayed quiet for six months can jump within 24 hours the day an exploit appears in a public repository. An EPSS score noted three weeks ago and copied into a spreadsheet is worthless: it is data to re-read, not to archive.
EPSS, CVSS, KEV: which one answers what
| CVSS | EPSS | KEV | |
|---|---|---|---|
| Answers | How much damage? | How likely? | Exploited, yes or no? |
| Scale | 0 to 10 | 0 to 1 | Binary |
| Changes? | No (base score) | Daily | By additions |
| Covers | All scored CVEs | All CVEs | About a thousand entries |
A CVSS 9 with an EPSS of 0.01 can wait for the maintenance window. A CVSS 6 with an EPSS of 0.8 is a problem for this week. A CVE in the KEV, whatever the rest says, is a problem for tonight.
What it means for you, in practice
A four-line triage policy, to write once and apply without debate:
- In the KEV and in your environment: fix within 48 hours.
- Otherwise, EPSS ≥ 0.10: fix within the week. This threshold keeps about one CVE in sixteen.
- Otherwise, EPSS ≥ 0.01 and CVSS ≥ 7: next update cycle.
- Everything else: routine updates, no meeting needed.
Re-check the EPSS of items 3 and 4 at every cycle: that is exactly where sudden jumps happen.