EPSS score explained
EPSS — the Exploit Prediction Scoring System, published by FIRST.org — estimates how likely a vulnerability is to be exploited in the wild in the next 30 days. Here is how to read it, and how to use it without over-trusting it.
What the number actually means
An EPSS score is a probability between 0 and 1. A score of 0.08 means the model puts roughly an 8% chance on exploitation activity being observed for that CVE within the next 30 days. It is a forecast about the internet at large, not about your network.
EPSS also publishes a percentile, which says how the CVE ranks against all others. A percentile of 0.97 means the CVE is in the top 3% by predicted likelihood. Percentiles are the easier number to communicate; the raw probability is the one to threshold on.
EPSS vs CVSS vs KEV
- CVSS — severity if exploited. Impact ceiling, mostly static.
- EPSS — predicted likelihood of exploitation. Updated daily.
- CISA KEV — confirmed exploitation, observed in real incidents. Not a prediction at all.
The practical rule: KEV outranks everything, EPSS orders what is left, and CVSS sizes the consequence so you know how much change-management pain is justified.
Working thresholds
These are starting points to calibrate against your own estate, not universal constants:
- ≥ 0.5 — treat as urgent when the component is present and exposed.
- 0.1 – 0.5 — high predicted exploit likelihood; schedule in the current sprint if the asset is reachable.
- 0.01 – 0.1 — elevated relative to the median; normal patch cycle.
- < 0.01 — the majority of CVEs. Monitor, and re-score weekly.
Common mistakes
- Reading EPSS as a severity score. It says nothing about impact.
- Scoring once and never refreshing. Scores move daily.
- Ignoring asset context. A high EPSS score on software you do not run is noise.
- Letting EPSS override KEV. Confirmed exploitation always beats a prediction.
Frequently asked questions
What is a good EPSS score?
EPSS is a probability, not a grade. Most CVEs score below 0.01 (a 1% chance of exploitation in the next 30 days). Scores above roughly 0.1 are unusual and worth acting on; above 0.5 they are strong urgency signals.
Is EPSS better than CVSS?
Neither replaces the other. CVSS estimates how much damage exploitation would cause; EPSS estimates how likely exploitation is. Using both together produces a far shorter and more accurate urgent list than either alone.
How often does EPSS change?
EPSS is recalculated daily. A CVE's score can rise sharply when exploit code is published or attacks are observed, so re-scoring your backlog on a schedule matters as much as the initial triage.
Does a low EPSS score mean a CVE is safe to ignore?
No. It means exploitation is currently unlikely across the internet at large. A low-EPSS CVE on an internet-facing, business-critical system can still deserve attention, and any CVE listed in CISA KEV should be treated as urgent regardless of its EPSS value.
Source: FIRST.org EPSS model documentation. See also our prioritization framework and security glossary.
See this on your own environment
Book a walkthrough and we'll show how VulnMonitor turns your scan results into a short, defensible patch list.