Exploit Prediction Scoring System

How EPSS Works

EPSS uses a machine learning model trained on observed exploitation activity and other signals about each vulnerability. The output is published openly every day for every scored CVE, as a CSV download and an API, so it can be pulled straight into vulnerability management workflows.

Probability vs Percentile

• Probability is an absolute estimate between 0 and 1. A score of 0.10 means roughly a 10% chance of exploitation activity being observed in the next 30 days.
• Percentile is a relative ranking against every other scored CVE. A vulnerability in the 90th percentile scores higher than 90% of all vulnerabilities.

EPSS vs CVSS

CVSS describes how severe a vulnerability could be if exploited. EPSS estimates how likely exploitation is. The two answer different questions, which is why they work well together. A vulnerability with a high CVSS score but a very low EPSS score may be less urgent than a moderate one that attackers are actively targeting.

What EPSS Does Not Tell You

FIRST is explicit that EPSS is not a complete risk score. It does not measure how much damage exploitation would cause, whether the vulnerable code is reachable in your application or how important the affected system is. It also only covers vulnerabilities that have a CVE.

Using EPSS in Prioritization

Teams typically combine EPSS with CVSS for severity, the CISA KEV catalog for confirmed exploitation, reachability analysis for whether the code can run and business context for impact. Nullify triage scores findings on reachability, exploitability, business context and confidence, and separates severity from priority so urgent issues stand out. See how Nullify prioritizes findings.