What it means
EPSS is a forecast about exploitation activity for a published vulnerability. It estimates the probability that exploitation will be observed in the wild during the next thirty days. A score of 0.08 represents an eight percent probability under the model, not eight percent of your systems being compromised. A percentile is different: it describes where the score ranks among other scored vulnerabilities. EPSS does not describe the consequences of exploitation or your environment’s defenses, and it should be recorded with its date because estimates change.
AN ILLUSTRATIVE SCENARIO
Choosing which findings need closer attention
A small company has more vulnerability findings than it can fix immediately. An analyst uses EPSS to identify findings with a higher predicted likelihood of exploitation, then checks whether the affected software is actually deployed and reachable. A known-exploited flaw on an important gateway stays urgent even if another vulnerability has a higher forecast. The model helps focus limited attention; it does not replace evidence that exploitation has already happened.
Put it to work
- Match findings to the correct CVE identifiers and obtain current EPSS probabilities. Keep the scoring date and distinguish the probability field from its ranking percentile.
- Use the forecast alongside known exploitation, technical severity, exposure, and asset importance. Decide and document how those separate inputs affect your remediation queue.
- Revisit priorities as forecasts, advisories, and your environment change. Keep an exception process for important vulnerabilities that a simple numerical threshold would miss.
How to check your work
Take a sample finding and explain the probability, percentile, and date in plain language. Check that the queue still prioritizes confirmed exploitation and critical local exposure instead of allowing the forecast to overrule stronger evidence.
Connect the ideas
- CVE
A public identifier for a specific disclosed vulnerability record.
- CVSS
FIRST’s method for describing characteristics and technical severity of a vulnerability, not a full remediation order.
- KEV
CISA’s catalog of vulnerabilities with evidence of exploitation in the wild.
- Likelihood
How plausible it is that a threat will cause a loss in this environment, given exposure and evidence.