Home / Knowledge hub / EPSS
Knowledge hub
EPSS
A score estimating how likely a vulnerability is to be exploited in the next thirty days.
What it means
EPSS stands for Exploit Prediction Scoring System. It is run by FIRST and gives each published vulnerability a probability between 0 and 1 that exploitation activity will be seen in the next thirty days. A score of 0.05 means roughly a five in a hundred chance. The model is refreshed daily as new data arrives.
It answers a different question from severity. A CVSS score says how bad a flaw would be if used. EPSS says how likely it is that someone will use it soon. A flaw can be severe and quiet, or modest and heavily abused.
Why it matters
Most teams have more open vulnerabilities than time. Fixing in order of severity alone means weeks spent on flaws nobody is touching while a lower-rated one is being used in the wild. A likelihood signal lets you spend limited hours where attackers are actually looking, and explain the order to a customer or auditor.
It does not replace judgement. EPSS knows nothing about your system. It does not know that a flaw sits behind your firewall, or that the affected function is switched off. Use it to sort the queue, then confirm with exploitability in your own setup.
How it shows up
EPSS scores are free to download from FIRST and are shown in many scanners and dashboards, usually beside the CVSS score and a flag for the CISA known exploited list. A common pattern is to raise priority when a flaw has a high CVSS score and a high EPSS score, and lower it when both are low.
The mistakes are treating a low score as safe and treating the number as fixed. Scores move as new evidence arrives, so a value from last quarter's report may be stale. It also covers only published CVEs, so a flaw in your own code, or a business-logic mistake, has no EPSS score at all.
Questions people ask
EPSS, answered
What does an EPSS score of 0.8 mean?
It means the model estimates an 80 percent chance that exploitation activity will be observed in the next thirty days. It is a probability, not a severity.
FIRST also publishes a percentile, which shows how the score ranks against all other scored vulnerabilities.
Is EPSS the same as CVSS?
No. CVSS describes the characteristics and potential impact of a flaw. EPSS estimates the chance of it being exploited.
They answer different questions and work best together. Use CVSS to judge the harm, and EPSS to judge the odds.
Does a low EPSS score mean I can ignore a vulnerability?
Not safely. A low score means exploitation is currently unlikely across the internet, not that it is impossible against you. A targeted attacker may not appear in the data.
Check whether the flaw is reachable in your system before deprioritising it.
Does EPSS cover flaws in my own code?
No. It scores published CVE entries only. A vulnerability in your own application has no CVE and no EPSS score.
Those flaws need to be found and rated by testing, with evidence of what an attacker can actually do.
Where do I get EPSS data?
FIRST publishes it for free, as a daily file and through an API, on its EPSS pages. Many vulnerability tools already show it beside the CVSS score.
Check how often your tool refreshes it, since the values change daily.
Sources
Where this comes from
Related
Terms that sit next to this one
CISA KEV catalogue
A government list of vulnerabilities known to be exploited in real attacks.
CVSS
A scoring system that turns a vulnerability into a number out of ten.
Exploitability
How easily and reliably a flaw can be used in practice.
Risk-based prioritisation
Ordering fixes by real-world risk, not just by the raw severity score.
SSVC
A decision tree that tells you whether to act on a vulnerability now or later.
Likely to be used, or just scary?
EPSS speaks about known CVEs. Our findings cover what is flawed in your own application, and each one carries the request and response that show it was exploited. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.