EPSS (Exploit Prediction Scoring System)

Only a small single-digit percentage of published CVEs are ever exploited in the wild, so patching by CVSS severity alone wastes effort on vulnerabilities attackers never touch.

EPSS is far more efficient: FIRST.org’s own analysis shows that patching a tiny fraction of CVEs by EPSS captures the majority of real-world exploitation, versus patching the majority of high-CVSS CVEs to achieve similar coverage.

EPSS is produced by a community effort under FIRST.org and is updated daily. It uses a data-driven model trained on real exploitation activity and a wide range of vulnerability characteristics to estimate, for each CVE, the probability that it will be exploited in the wild within the next thirty days. The output is a score between zero and one, alongside a percentile that shows how a vulnerability ranks against all others.

The purpose of EPSS is to answer a question that severity scoring cannot: how likely is this vulnerability to actually be attacked? CVSS measures how bad exploitation would be if it happened, but the large majority of vulnerabilities are never exploited. EPSS adds the missing dimension of likelihood, so teams can concentrate on the small share of flaws that carry real-world risk.

In practice EPSS is most powerful when combined with other signals rather than used alone. A common approach pairs EPSS probability with CISA KEV status, which confirms known exploitation, and with CVSS severity, so that prioritisation reflects both how likely exploitation is and how damaging it would be. This combination consistently outperforms any single metric at focusing remediation effort.

EPSS has become a core input to modern risk-based vulnerability management precisely because it is dynamic. A vulnerability’s EPSS score can rise sharply when exploit code is published or attacks are observed, giving defenders an early signal to act before a flaw is widely weaponised, and it can remain low for the many CVEs that never attract attacker interest.

The EPSS model draws on a broad set of inputs, including characteristics of the vulnerability, references and metadata, the presence of published exploit code, and observed exploitation activity, to produce its probability estimate. Because it is retrained and rescored daily, a vulnerability’s EPSS score responds to real-world developments: it can climb sharply when an exploit is released or attacks begin, giving defenders an early, data-driven signal to act.

EPSS and CVSS answer different questions and are strongest together. CVSS estimates how severe exploitation would be; EPSS estimates how likely exploitation is. A vulnerability that is both severe and probable is an obvious priority, while a severe vulnerability that is very unlikely to be exploited may reasonably wait. Adding CISA KEV, which confirms known exploitation, completes a prioritisation model that reflects likelihood, impact and confirmed activity together.

Precursor uses EPSS as one dimension of the exploitation risk score, combined with CISA KEV, CVSS impact, CWE weighting and threat-actor attribution, which uses live exploitation data from Shadowserver honeypot sensors.