What is EPSS and how to use it to prioritise vulnerabilities more efficiently
By Kike Gandia · Co-Founder & CEO, OSCP
The Exploit Prediction Scoring System (EPSS) is a probabilistic model developed by FIRST that predicts the likelihood of a vulnerability being exploited within the next 30 days. Unlike CVSS, which measures theoretical severity, EPSS measures real-world risk based on observed exploitation data. Using them together transforms vulnerability prioritisation.
Why CVSS alone is not enough for prioritisation
CVSS scores the technical severity of a vulnerability based on characteristics such as attack vector, complexity or potential impact. The problem: a 9.8 CVSS score does not mean someone is going to exploit it tomorrow. Historically, fewer than 5% of CVEs with a critical CVSS score are actually exploited in practice. With CVSS, everything above 9.0 is 'critical' — but patching hundreds of criticals simultaneously is impossible. An additional exploitation probability criterion is needed.
What EPSS measures and how it works
EPSS assigns each CVE a score between 0 and 1 representing the probability of it being exploited within the next 30 days. The EPSS v3 model uses threat intelligence data from multiple sources: GreyNoise, Shodan, exploit feeds, malware databases and historical exploitation data. It is updated daily.
How to interpret the EPSS score
An EPSS score of 0.9 means a 90% probability of exploitation in the next 30 days. A score of 0.001 means 0.1% — very low. Most CVEs have an EPSS below 0.05 (5%), which massively helps filter a vulnerability backlog.
Combining CVSS and EPSS: the prioritisation matrix
The most effective strategy combines both metrics in four quadrants:
- High CVSS + High EPSS → patch immediately (technically severe AND active exploitation)
- High CVSS + Low EPSS → monitor (severe but no observed exploitation)
- Low CVSS + High EPSS → evaluate context (may serve as initial access vector)
- Low CVSS + Low EPSS → low-priority backlog
How to access EPSS scores
FIRST publishes EPSS scores for free at epss.cyentia.com. They are also available through the NVD API and integrated into major vulnerability management platforms such as Tenable, Qualys and Rapid7.
FAQ
Does EPSS replace CVSS?
No, they are complementary. CVSS measures the intrinsic technical severity of the vulnerability. EPSS measures the probability of exploitation within the current threat landscape. Using both together gives a much more complete picture than either on its own.
How often is EPSS updated?
The EPSS model is updated daily. A vulnerability with a low EPSS today may rise significantly tomorrow if a public exploit is published or active exploitation is detected. That is why it is important to monitor EPSS continuously, not only at the time the CVE is published.
Does EPSS work for newly published vulnerabilities?
For very recent CVEs (less than 30 days old), the EPSS score may be less reliable because the model has less observational data. In those cases, CVSS 4.0, CISA's Known Exploited Vulnerabilities (KEV) catalogue and your specific architecture context are additional important criteria.
Related service
Related content
Sources
- OWASP Web Security Testing Guide (WSTG) — the official reference methodology
- INCIBE — Pentesting and security testing guide for businesses
We implement a CVSS + EPSS prioritisation strategy for your team