What is EPSS?
The Exploit Prediction Scoring System (EPSS) is a data-driven model that gives each published CVE a probability, from 0 to 1, that exploitation activity against it will be observed in the next 30 days. It is developed by a special interest group at FIRST, the organization that also maintains CVSS, and the scores are free to download or query through an API. EPSS recalculates every score daily, so a CVE's number can jump when exploit code is published or attacks begin.
How to read a score
EPSS reports two numbers for each CVE:
- Probability: 0.85 means an estimated 85 percent chance that exploitation activity will be observed in the next 30 days. Most CVEs score very low, many well under 0.01.
- Percentile: where the score ranks against every other scored CVE. Because so many CVEs score near zero, a probability that sounds modest can still rank above most of them.
The model draws on information such as the vendor and product, the weakness type, how long the CVE has been public, whether exploit code or scanner templates exist, and exploitation attempts recorded by partners' sensors. FIRST retrains the model periodically, so scores produced by different model versions should not be compared directly.
EPSS in a worked example
| Finding | CVSS base | EPSS |
|---|---|---|
| Deserialization flaw in a file transfer server | 8.1 | 0.89 |
| Remote code execution in a lab server's management service | 9.8 | 0.004 |
| Stored XSS in an internal wiki | 6.1 | 0.02 |
Sorted by CVSS, the lab server comes first. Sorted by EPSS, the file transfer server does, because attackers are far more likely to go after that flaw soon. A sensible plan patches the file transfer server first, confirms that the lab server really is isolated, and leaves the wiki for the normal cycle. The values here are illustrative; real scores change every day.
Limits of EPSS
EPSS estimates how likely a flaw is to be targeted somewhere on the internet. It does not know whether you run the product, whether your system is exposed, or what data sits on it. A low score is not permission to ignore a vulnerability; it means findings under active attack should usually go first. EPSS also scores only published CVEs, so it says nothing about a misconfiguration or a flaw in software your company wrote. Combine it with asset criticality, exposure and the KEV catalog.
EPSS vs. CVSS vs. KEV
- CVSS rates severity: how bad exploitation would be, assuming it happens.
- EPSS forecasts likelihood: how probable exploitation activity is over the next month.
- KEV records history: exploitation has already been confirmed.
A high CVSS score with a low EPSS score is a serious flaw that nobody seems to be using yet. A moderate CVSS score with a high EPSS score is often the more urgent fix.
EPSS on the CompTIA Security+ exam
EPSS is taught with likelihood and vulnerability prioritization under SY0-801 objective 2.1, applied to scan results under objective 4.3, and mentioned again as a prediction aid in the security automation material under objective 4.6. The acronym is not on the SY0-801 acronym list. Wording such as "the probability that a vulnerability will be exploited in the next 30 days" or "predict which CVEs attackers are likely to use" points to EPSS. "How severe is the flaw" points to CVSS, and "already exploited in the wild" points to KEV. A tempting wrong answer treats EPSS as a severity score or as a measure of your own exposure.