What Is EPSS (Exploit Prediction Scoring System)?
EPSS is a FIRST-maintained machine learning model that predicts the probability a vulnerability will be exploited in the next 30 days, a different question than CVSS, which only measures potential severity. Since just 2-7% of disclosed CVEs are ever actually exploited, EPSS helps teams avoid wasting remediation effort on "critical" vulnerabilities attackers were never going to touch, and works best combined with CVSS and CISA's KEV catalog rather than used alone.
The Exploit Prediction Scoring System (EPSS) is a machine learning model, maintained by FIRST, that estimates the probability that a given vulnerability will actually be exploited in the wild within the next 30 days, expressed as a score between 0 and 1. Unlike CVSS, which rates how bad a vulnerability could be, EPSS answers a different question entirely: how likely it is that this specific vulnerability will actually be attacked, based on real exploitation data.
That distinction matters more than it sounds. Thousands of new vulnerabilities get disclosed every year, and CVSS alone labels a large share of them "high" or "critical." But only a small fraction, roughly 2-7% of all CVEs, are ever actually exploited. Treating every critical-rated vulnerability with equal urgency means security teams burn time and resources on issues attackers were never going to touch, while genuinely dangerous ones wait in the same queue.
How does EPSS actually calculate a score?
EPSS uses a machine learning model, currently a gradient-boosted decision tree architecture, trained on a large set of variables tied to each vulnerability. Rather than relying on a single input, it pulls together several categories of signal:
• Exploit availability: whether proof-of-concept or fully weaponized exploit code exists in public repositories, exploit databases, or less visible forums
• Active exploitation evidence: signals from threat intelligence feeds, honeypots, and security vendor telemetry showing a vulnerability is actually being targeted right now
• Vulnerability characteristics: the CVE's age, its CVSS metrics, the affected product category, and related threat actor activity
• Social and media signals: mentions in security advisories, news coverage, and mailing lists, which tend to correlate with rising attacker interest
The model recalculates scores for every published CVE daily, so a vulnerability's EPSS score can shift quickly if new exploit code surfaces or active targeting gets detected.
How do you read an EPSS score?
A score close to 1 means the model considers exploitation highly likely within the next 30 days. A score close to 0 means the opposite, not that data is missing, but that based on everything the model has observed, exploitation in that window is unlikely. EPSS scores also include a percentile ranking, which shows how a given CVE compares to all other scored vulnerabilities. A CVE at the 98th percentile scored higher than 98% of all other tracked vulnerabilities, which is often more actionable for triage than the raw probability alone.
It's worth being clear about what EPSS isn't. It doesn't measure how much damage a successful exploit would cause, and it has no visibility into your specific environment, whether the vulnerable system is internet-facing, what data it holds, or what compensating controls you already have in place. EPSS estimates likelihood. It's not a complete risk score on its own.
How is EPSS different from CVSS?
CVSS and EPSS answer two different questions, and that's exactly why security teams increasingly use them together rather than picking one. CVSS asks: if this vulnerability is exploited, how bad would the impact be? EPSS asks: how likely is exploitation to actually happen? A vulnerability can score high on both, high on one and low on the other, or low on both, and each combination should shape remediation priority differently.
Published research from FIRST illustrates the practical gap well. Remediating every CVE with a CVSS score of 7 or higher catches 82% of vulnerabilities that end up exploited, but 96% of that remediation effort goes toward vulnerabilities that were never going to be exploited anyway. Remediating based on an EPSS threshold of 10% or higher catches a smaller share of eventually-exploited vulnerabilities, but with dramatically less wasted effort spent on ones that didn't need urgent attention. Neither approach alone is perfect, which is exactly why combining severity, exploit likelihood, and known exploitation, via CISA's KEV catalog, gives a more complete prioritization picture than any single score.
EPSS vs. CVSS at a glance
| Dimension | CVSS | EPSS |
|---|---|---|
| Question Answered | How severe is this vulnerability? | How likely is exploitation in the next 30 days? |
| Score Range | 0-10 | 0-1 (0-100%) |
| Basis | Technical characteristics of the flaw | Real-world exploitation data, updated daily |
| Environmental Context | Partial (via environmental metrics) | None, needs to be added separately |
| Best Used For | Understanding potential impact | Prioritizing what to fix first |
FAQ
Is a high EPSS score a guarantee a vulnerability will be exploited?
No. EPSS scores are probabilistic, not deterministic. A high score means the model considers exploitation likely based on current data, but it's a forecast, not a certainty. Likewise, a low score doesn't guarantee a vulnerability will never be exploited, it means exploitation was considered unlikely at the time the score was calculated.
How often are EPSS scores updated?
Daily. FIRST recalculates scores for every published CVE each day, drawing on newly observed exploit activity, fresh threat intelligence, and any changes in exploit code availability. This means a vulnerability's score can rise quickly if new exploitation evidence appears.
Should organizations use EPSS instead of CVSS?
No, they answer different questions and work best together. CVSS tells you what the potential impact would be if a vulnerability is exploited. EPSS tells you how likely exploitation actually is. Combining both, often alongside CISA's Known Exploited Vulnerabilities catalog for confirmed active exploitation, gives a far more complete basis for prioritization than either score alone.
Who maintains EPSS, and is it free to use?
EPSS is maintained by FIRST (Forum of Incident Response and Security Teams), the same organization behind CVSS. Scores are published daily and are freely accessible via CSV download, API, and a public GitHub repository, which is a big part of why major vulnerability management platforms integrate it directly.
What version of EPSS is currently in use?
EPSS v4, released March 17, 2025, is the current version. It followed v3 (2023), which improved predictive performance substantially over v2 (2022), which in turn built on the original model published in 2019. FIRST continues to release updated versions as exploitation patterns and available data evolve.
Conclusion
EPSS solves a real problem: most vulnerabilities rated critical by CVSS alone are never actually exploited, and chasing all of them wastes remediation capacity that should go toward the small share attackers are genuinely targeting. Saner CVEM factors exploit likelihood into its prioritization, alongside severity and exposure, across endpoints, OS, firmware, and third-party software, so remediation effort goes toward what's actually likely to be attacked, not just what scored highest on paper.