EPSS (exploit prediction)
EPSS · Exploit Prediction Scoring System · EPSS score · exploitation probability · vulnerability prioritisation
A score published by FIRST that estimates, between 0 and 1, the probability that a published vulnerability (CVE) will be exploited in the next 30 days.
In practice
EPSS relies on a machine learning model fed with observed data: published exploit code, mentions in threat intelligence feeds, attempts detected by sensors, characteristics of the flaw. Scores are recalculated every day for every CVE, along with a percentile: a percentile of 95 means the flaw scores the same as or higher than 95% of all others. Version 4 of the model has been in use since March 2025. EPSS complements CVSS rather than replacing it: CVSS tells you how bad it would be, EPSS how likely it is.
Fictional case: two flaws rated 9.8 on CVSS land on the same day. The first has an EPSS of 0.02 (2%); the second, at 0.89 (89%), also affects an internet-facing server, so that is the one the team fixes first, the same day.
