What Is EPSS Exploit Prediction?

EPSS (the Exploit Prediction Scoring System, from FIRST) is a probability between 0 and 1 that a given CVE will be exploited in the wild in the next 30 days. Unlike CVSS, which scores severity, EPSS scores likelihood of attack, so it tells you which vulnerabilities to fix first. A CVE with CVSS 9.8 but EPSS 0.02 is far less urgent than one with CVSS 6.5 and EPSS 0.90.

How EPSS works

FIRST recomputes EPSS daily from real-world exploitation signals (exploit code availability, references, CVE metadata, observed activity). You read it per CVE as a score plus a percentile, and use it to rank a backlog by probability of attack rather than by worst-case impact. Because it is recomputed daily, a CVE's EPSS can climb sharply the week an exploit goes public.

EPSS vs CVSS

CVSS answers "how bad is it if exploited"; EPSS answers "how likely is it to be exploited." They are complementary, not interchangeable. In a corpus of ~330,000 CVEs with CISA KEV as ground truth, EPSS was roughly 10 times better than CVSS at predicting actual exploitation: CVEs at EPSS >= 0.5 were exploited about 15% of the time, versus about 1.4% for critical-CVSS (9.0 to 10.0) CVEs. Use CVSS for the impact dimension and EPSS (plus KEV) for likelihood.

How to use EPSS with vulntel

enrich_cve returns the current EPSS score and percentile fused with CISA KEV status and the SSVC decision, so your agent prioritizes on likelihood-of-exploit, not just severity, in one call. See the EPSS documentation for the exact fields, or the broader CVE enrichment picture.

FAQ

What is a good EPSS score? There is no fixed universal threshold; teams commonly escalate somewhere in the ~0.1 to 0.5 range depending on risk appetite, and treat anything in KEV as top priority regardless of its EPSS. Combine EPSS with KEV: a known-exploited CVE overrides the probability.

EPSS vs CVSS, which should I use? Both. CVSS scores severity (impact if exploited); EPSS scores probability of exploitation in the next 30 days. Prioritize with EPSS and KEV, and use CVSS to weigh how much the impact matters.

How often is EPSS updated? Daily. FIRST recomputes every CVE's EPSS score each day, so it moves as new exploit and activity signals appear.

Where does EPSS data come from? FIRST publishes EPSS. You can read it directly from FIRST, or get it fused with KEV, SSVC and a PoC signal per CVE through vulntel's enrich_cve tool.