What Is EPSS? The Exploit Prediction Scoring System Explained for Security Teams

EPSS is the Exploit Prediction Scoring System. It is an open model maintained by FIRST.org (the Forum of Incident Response and Security Teams) that outputs a probability score between 0.0 and 1.0 for each CVE in the NVD. The score represents the model's prediction of how likely that CVE is to be observed exploited in the wild within the next 30 days. A score of 0.05 means 5 percent probability. A score of 0.97 means 97 percent probability. The score is updated every day as new signals are ingested.

EPSS was developed by Jay Jacobs (Cyentia Institute) and Michael Roytman. The project is hosted under FIRST.org, which also maintains the CVSS standard. EPSS v1 launched in 2021. EPSS v3 (released 2023) significantly improved model accuracy by expanding feature inputs, adding percentile ranking, and improving calibration for low-probability CVEs. The model and its methodology are published openly, including the feature set and training approach.

EPSS v3 ingests multiple data sources to generate each daily score. Key features include: CVE age (how long since publication), CVSS base score and component subscores, public exploit availability (whether a working exploit exists in Exploit-DB, Metasploit, or GitHub), social media and security community discussion volume, darkweb and underground forum mentions, commercial scanner detection frequency (how many scanners have added a plugin for this CVE), and vendor advisory activity. The model uses a gradient boosted classifier trained on historical exploitation observations. FIRST.org publishes calibration data showing how closely EPSS scores match actual exploitation rates.

An EPSS score of 0.97 means the model has high confidence this CVE will be exploited within 30 days. Score interpretation by range: 0.00 to 0.01 is low probability, treat as deprioritized unless CVSS is critical; 0.01 to 0.10 is moderate, worth tracking; 0.10 to 0.50 is elevated, consider accelerating patch timelines; 0.50 to 1.00 is high, treat as active-exploitation-level priority. The percentile rank is often more useful than the raw score: a score of 0.02 sounds low but may be in the 70th percentile if most CVEs score below 0.01.

The EPSS API returns both the raw probability and a percentile rank. The percentile rank tells you where a CVE falls relative to all other CVEs in the dataset. Because the distribution is heavily right-skewed (most CVEs are never exploited), a raw score of 0.05 can represent a very high relative risk. FIRST.org recommends using percentile rank as the primary triage signal, with raw probability reserved for absolute-threshold SLA decisions (for example, patching anything above 0.1 raw probability within 48 hours).

EPSS data is available through several channels. The FIRST.org API at api.first.org/data/v1/epss returns scores for individual CVEs or bulk queries. The full daily dataset is available as a downloadable CSV from epss.cyentia.com. NVD integrates EPSS scores into individual CVE pages. Commercial platforms including Tenable (Vulnerability Priority Rating integrates EPSS), Qualys TruRisk, and Rapid7 InsightVM surface EPSS within their dashboards. Many SIEM and SOAR vendors have added EPSS enrichment as a standard pipeline component.

CVSS measures intrinsic severity: how bad would exploitation be, how complex is it to exploit, are privileges required, what is the impact on confidentiality, integrity, and availability. CVSS does not capture whether anyone is actually trying to exploit the vulnerability. EPSS measures exploitation likelihood in the near term, grounded in observed attacker behavior, but does not capture impact. A CVSS 9.8 vulnerability with an EPSS score of 0.001 is theoretically severe but currently ignored by attackers. A CVSS 5.5 vulnerability with an EPSS score of 0.85 is actively being exploited right now. Prioritization decisions are better when both signals are used together.

The recommended approach from FIRST.org and CISA is a combined model: use CVSS to establish a severity floor (do not deprioritize critical-impact vulnerabilities regardless of EPSS), then use EPSS percentile to rank remediation order within each severity tier. CISA's Known Exploited Vulnerabilities catalog provides a third layer: any CVE in the KEV catalog has confirmed exploitation and should be treated as highest priority regardless of EPSS score. The combination of CVSS severity, EPSS probability, and KEV confirmation covers most prioritization scenarios.

AI-discovered CVEs from Project Glasswing present an interesting EPSS profile. At the moment of coordinated disclosure, a novel AI-discovered CVE often has a low initial EPSS score because there are no public exploits, no scanner plugins, and limited community discussion. EPSS scores for Glasswing CVEs typically rise rapidly in the days following public disclosure as proof-of-concept code is published and scanners add detection. CVE-2026-5194 (wolfSSL, CVSS 9.1) and CVE-2026-4747 (FreeBSD) both showed this pattern: low initial EPSS, rising sharply within 72 hours of public disclosure.

EPSS is calibrated on historical exploitation patterns. For genuinely novel vulnerability classes, including the first AI-discovered bugs in a category, the model has less signal to work with. A sophisticated AI-found vulnerability in a library with no public exploit, no prior CVE history, and no community discussion can score very low on EPSS despite representing significant risk. For organizations in the path of advanced threats, EPSS should be supplemented with threat intelligence specific to their attacker profile, not used as a standalone signal.

A step-by-step EPSS integration guide for vulnerability management programs, including API setup, SIEM enrichment, SLA threshold recommendations, and the full EPSS score history for all 9 Glasswing CVEs from initial disclosure to peak, is available in the Mythos Brief.