EPSS (Exploit Prediction Scoring System)

EPSS is a prediction, not a measurement. A model trained on which past CVEs were exploited, and on what they had in common (vendor, product, vulnerability type, the existence of public exploit code, mentions in security feeds) outputs, for each current CVE, the probability that exploitation activity will be observed in the next 30 days.

The output is a number between 0 and 1 and a percentile. Most CVEs score below 1 %; a score above 10 % puts a vulnerability in the top few percent of everything published. Scores move: the day an exploit is released or a vulnerability is added to KEV, the EPSS jumps, so it should be read fresh rather than recorded once.

CVSS, EPSS and KEV answer three different questions. CVSS asks how bad the vulnerability would be if exploited, and gives a severity from 0 to 10 that never changes once published. EPSS asks how likely it is to be exploited in the next 30 days, and gives a probability that is recomputed daily as exploitation evidence arrives. KEV asks whether it is already being exploited, and gives a yes or no from CISA. A CVSS 9.8 with an EPSS of 0.4 % and no KEV entry is a theoretical emergency; a CVSS 6.5 in the KEV catalog is a practical one. Prioritisation that uses only the first number patches the wrong things first.