CVSS vs EPSS: which should you use to prioritise vulnerabilities
By Kike Gandia · Co-Founder & CEO, OSCP
CVSS and EPSS are the two most widely used metrics in vulnerability management, but they measure different things. Using only CVSS leads to prioritising theoretically severe vulnerabilities that are never exploited in practice. Using only EPSS can lead to ignoring critical vulnerabilities with low immediate exploitation probability but devastating impact. The answer, as almost always in security, is that you need both.
What CVSS measures and its limitations
The Common Vulnerability Scoring System (CVSS) evaluates the intrinsic severity of a vulnerability based on technical characteristics: attack vector, complexity, privileges required, user interaction and impact on confidentiality, integrity and availability. The current version is CVSS 4.0, published by FIRST in November 2023.
The problem with CVSS as the sole prioritisation criterion is that a vulnerability can have a CVSS of 9.8 (critical) and go three years without being exploited in the wild. If your team prioritises exclusively by CVSS, it will spend resources patching vulnerabilities that no one is attacking, while leaving others with lower CVSS but active exploitation unaddressed.
What EPSS measures and how it works
The Exploit Prediction Scoring System (EPSS) is a machine learning model developed by FIRST that predicts the likelihood of a vulnerability being exploited within the next 30 days. It is updated daily with real-world exploitation data (exploits in the wild, honeypot activity, threat intelligence feeds).
EPSS returns a percentage: 0.01 means that 1% of vulnerabilities with a similar score are exploited within 30 days. 0.97 means the probability of exploitation is very high.
The key point: fewer than 5% of published CVEs have an EPSS above 0.1. The remaining 95% have a very low probability of exploitation, regardless of their CVSS score.
How to combine CVSS and EPSS for accurate prioritisation
The most efficient combination:
- High CVSS + High EPSS → Maximum priority. Patch immediately.
- High CVSS + Low EPSS → Medium priority. Severity is high but no active exploitation. Patch in the next planned cycle.
- Low CVSS + High EPSS → High priority. The theoretical impact is limited, but someone is exploiting it. Investigate and patch soon.
- Low CVSS + Low EPSS → Low priority. Manage in normal maintenance cycles.
This matrix dramatically reduces the number of vulnerabilities requiring urgent attention and improves prioritisation accuracy.
Why business context always has the final say
Neither CVSS nor EPSS knows your environment. A CVSS 7.5 vulnerability on an internal server with no internet access carries a much lower real-world risk than the same vulnerability on your public-facing API. Context you must always factor in:
- Is the affected system exposed to the internet?
- Does it process sensitive or regulated data?
- Are there compensating controls that reduce the impact?
- Is it a system critical to business continuity?
The CVSS Environmental Score allows you to incorporate this context into the calculation, adjusting the base score to your specific environment.
FAQ
Does EPSS replace CVSS?
No, they are complementary. CVSS measures the intrinsic technical severity (how severe if exploited). EPSS measures the probability of exploitation (how likely someone is to exploit it soon). You need both metrics to make well-grounded prioritisation decisions.
Where can I check the EPSS score for a CVE?
EPSS is published daily at first.org/epss and is available in most vulnerability management platforms (Tenable, Qualys, Rapid7). You can also query it via the FIRST public API or on the NVD.
What is CVSS 4.0 and how does it improve on CVSS 3.1?
CVSS 4.0 introduces a more granular metric taxonomy, improves scoring for OT/ICS environments, adds supplementary metrics (automation, recovery) and removes ambiguities in temporal metric interpretation. For most web vulnerabilities, the most notable change is greater precision in impact assessment.
Related service
vulnerability validation and prioritisation service