EPSS: The Exploit Prediction Scoring System Explained

EPSS (the Exploit Prediction Scoring System) estimates the probability that a published vulnerability will be exploited in the wild in the next 30 days. Each CVE gets a score from 0 to 1, recalculated daily by a model maintained by FIRST, the Forum of Incident Response and Security Teams. It answers “how likely?”, where CVSS answers “how bad?”.

What is an EPSS score?

An EPSS score is a probability. A score of 0.02 means an estimated 2% chance that the vulnerability will see exploitation activity in the next 30 days; 0.70 means 70%. Every score comes with a percentile, which shows the share of all scored CVEs with the same or a lower score, so you can see how one vulnerability ranks against the rest.

Most scores are small. FIRST’s EPSS FAQ explains that scores cluster near zero because most vulnerabilities are never exploited, and that a score of 0.10 currently sits around the 95th percentile. That is why the percentile matters: a CVE with a 10% probability already ranks in roughly the top 5% of everything scored, even though the raw number looks low.

These bands are a starting point, not an official scale: FIRST does not define labels such as “high” or “critical” for EPSS scores.

FIRST’s EPSS Special Interest Group builds the model from information about each vulnerability and from observed exploitation activity, and retrains it periodically, roughly once a year according to FIRST; the current model, version 5 (labelled v2026.06.15 in the score files), replaced version 4 on 15 June 2026. Scores are free to download or query through an API from the FIRST EPSS pages, and some scanning and vulnerability management tools show them next to each CVE.

What is the difference between EPSS and CVSS?

They measure different things, so use both. CVSS rates the technical severity of a vulnerability; EPSS estimates how likely it is to be exploited soon.

A third signal sits alongside both. The US CISA Known Exploited Vulnerabilities (KEV) catalogue lists CVEs with reliable evidence of exploitation in the wild. KEV records a fact and EPSS makes a forecast, so treat a CVE on the KEV list as urgent whatever its EPSS score.

How should you use EPSS to prioritise patching?

Set the deadlines first, then use EPSS to decide the order of work inside them. EPSS can bring a fix forward, but it never moves an item out of a deadline a standard sets:

• Cyber Essentials. Under the NCSC’s Requirements for IT Infrastructure v3.3, updates must be installed within 14 days of release where the vendor rates them critical or high risk, where they fix a vulnerability with a CVSS v3 base score of 7 or more, or where the vendor gives no rating. A low EPSS score does not change that. Our Cyber Essentials checklist covers the full rule.
• PCI DSS v4.0.1. Requirement 6.3.3 requires patches for critical vulnerabilities, as ranked by your process under Requirement 6.3.1, to be installed within one month of release. Other applicable patches must go in within a time frame you set from your own assessment of risk, and EPSS can be one documented input to that ranking.

A simple way to combine the two scores:

Then weigh exposure: an internet-facing payment server outranks an isolated test machine with the same scores. A vulnerability assessment adds that context to raw scanner output. In a continuous threat exposure management (CTEM) programme, EPSS is one input to the prioritisation stage.

What are the limits of EPSS?

• CVEs only. Flaws in bespoke code and misconfigurations found in a penetration test have no CVE, so EPSS cannot score them.
• Not about you. It predicts exploitation activity anywhere, not against your systems, and knows nothing about your exposure or data.
• Likelihood, not impact. A critical flaw in your cardholder data environment with a low score still needs fixing.
• It moves. A score can rise sharply when exploit code is published, so rescore open items rather than trusting last month’s number.

Vulnerability management is the process that ties severity, likelihood, owners and deadlines together.

Why Sovereign Secure?

We are a PCI SSC Qualified Security Assessor (QSA) company and ISO 27001 certified. We test web applications, APIs, networks, cloud, mobile apps, hardware and IoT, wireless, social engineering, red team, source code and AI/LLM systems, and run vulnerability scanning, with findings rated against CVSS and business impact. You can add EPSS to those ratings when you plan your fixes, and our guide to reading a penetration test report explains the rest of a report.

To find out which of your exposed systems carry exploitable flaws, request a penetration testing quote or call +44 161 523 5276. You can also browse more terms in our cyber security glossary.