Glossary
EPSS
A statistical model that estimates the probability of a specific vulnerability being exploited in the wild over the next thirty days.
- Exploit Prediction Scoring System
EPSS is maintained by FIRST and recomputed daily from observed signals: reported exploitation activity, CVE characteristics and the availability of public exploits. It returns two numbers worth keeping apart.
The probability is a value between 0 and 1. A score of 0.08 means the model estimates an 8 % chance of observed exploitation over the period. The percentile says what proportion of the catalogue scores lower. A percentile of 0.97 is not a 97 % probability: it only says the vulnerability sits in the top 3 % most likely, which can still be a small absolute figure.
In practice EPSS works better as a discard criterion than as an urgency criterion. It is good at moving the large volume of CVEs that will never be exploited off the critical path, but it cannot decide on its own what gets patched first: it does not know whether the asset is exposed or which function it supports. And if the CVE appears in CISA’s KEV catalogue, the estimate is redundant — exploitation has already been observed.