6 minute read
EPSS estimates how likely attackers are to exploit a published CVE in the next 30 days. Security teams use it to order third-party patches, but it has no score for vulnerabilities in the code their own engineers write.
Key takeaways
The Exploit Prediction Scoring System (EPSS) is a free model that estimates the probability that attackers will try to exploit a published CVE in the next 30 days. FIRST, the Forum of Incident Response and Security Teams, maintains EPSS and publishes new scores every day.
Each CVE gets two numbers. The probability is a value between 0 and 1, so a score of 0.2 means a 20% chance of exploitation attempts in the next 30 days. The percentile shows how the CVE ranks against every other scored CVE, so a CVE in the 95th percentile scores higher than 95% of all CVEs.
EPSS is a machine learning model trained on exploitation attempts that FIRST's data partners see in real network traffic. For each CVE, the model looks at facts such as the vendor and product, the type of vulnerability, the age of the CVE, whether exploit code is public, and how often security tools and researchers mention the CVE. The current model, version 4, was released in March 2025.
CVSS, EPSS, and KEV answer different questions about the same CVE, so teams often use all three together.
| Signal | Question it answers | Scale | Who publishes it |
|---|---|---|---|
| CVSS | How severe is the vulnerability in general? | A severity score from 0 to 10 | FIRST maintains the standard. Vendors and the National Vulnerability Database (NVD) assign scores |
| EPSS | How likely are attackers to try to exploit it in the next 30 days? | A probability from 0 to 1, and a percentile | FIRST, updated every day |
| CISA KEV | Have attackers already exploited it? | Listed in the catalog or not listed | CISA, updated as new exploitation is confirmed |
All three scores describe the CVE. None of them knows whether the vulnerable system is reachable in your environment, what data it holds, or which controls sit in front of it.
A CVE in the Known Exploited Vulnerabilities catalog is already being exploited, so it goes first whatever its EPSS score. EPSS then points to the CVEs attackers are most likely to exploit next.
FIRST does not publish an official cutoff. Pick a probability or percentile that gives your team a number of CVEs it can patch in time.
A high EPSS score on an internal test server can wait behind a lower score on your login page, because only the login page faces the internet. EPSS scores the CVE. You know which of your systems an attacker can reach.
Scores change every day. A CVE with a low score this week can jump when exploit code becomes public.
CVEs go to products and services that other organizations use. A broken access check in your API, a business logic flaw in your checkout, or a misconfigured storage bucket never gets one, so EPSS has nothing to score. Pentests, bug bounty programs, and code scanners find these vulnerabilities every week, and none of them comes with an EPSS score.
Engineering teams ship more of their own code every year, and coding agents let them ship it faster. Every new service, API endpoint, and integration adds code that no public database tracks. If your team ranks findings by EPSS, a growing share of the backlog has no score.
Even for third-party CVEs, EPSS predicts what attackers do across the whole internet. It can't tell whether your service loads the vulnerable package, or which team owns the fix.
For findings that have no CVE, judge each vulnerability by what an attacker can do with it:
For the full method, read vulnerability prioritization beyond CVSS.
aisy investigates every ticket to learn how your company works, including findings in your own code that no score covers. The next finding arrives with the root cause, the owner, and the fix.
EPSS stands for Exploit Prediction Scoring System. It is a model maintained by FIRST, the Forum of Incident Response and Security Teams, that estimates how likely a published CVE is to be exploited in the next 30 days.
The CVSS base score measures how severe a vulnerability is in general, on a scale from 0 to 10. EPSS estimates the probability that attackers try to exploit the vulnerability in the next 30 days, on a scale from 0 to 1. Neither score knows whether the vulnerable system is reachable in your environment or what data it holds.
There is no official EPSS threshold. FIRST publishes the probability and the percentile and leaves the cutoff to each team. Choose a threshold based on how many CVEs your team can fix in time, and act on every CVE in the CISA Known Exploited Vulnerabilities catalog whatever its EPSS score.
No. EPSS only scores published CVEs. A vulnerability in code your team writes, such as a broken access check in your API, never gets a CVE, so it never gets an EPSS score. Judge these findings by exposure, by what the system holds, by what the bug chains with, and by its root cause.
FIRST updates EPSS scores every day. A score can jump when exploit code becomes public or attackers start to use the vulnerability, so check the score again before you defer a CVE.
Yes. FIRST publishes EPSS scores for free as a daily download and through a public API.
Bring a recurring problem from your security backlog. We’ll look at what your team already knows, what it keeps re-checking, and how to get ahead of it.
Shlomie Liberow · Founder, aisy · shlomie@aisy.ai
