The Exploit Prediction Scoring System (EPSS) is a model that estimates how likely it is that a published vulnerability will be exploited in the wild. FIRST describes the estimate as a probability over the next 30 days. Teams can use it to help decide which vulnerabilities to fix first.
- Also Called2other namesEPSS · exploit prediction score
- Related Terms3linked entriesVulnerability management
What is the Exploit Prediction Scoring System?
The Exploit Prediction Scoring System is a model that estimates how likely it is that a published vulnerability will be exploited in the wild. FIRST describes it as an estimate of the probability that a published CVE will be exploited in the wild in the next 30 days. A CVE is a publicly listed vulnerability with its own identifier. Exploited in the wild means attackers are really using the flaw, not just testing it in a lab.
Who runs EPSS?
FIRST describes the EPSS Special Interest Group as a practitioner community, says the scores are maintained through FIRST, and says they are free to use. FIRST is a forum of incident response and security teams.
How does EPSS work?
EPSS is a machine-learning model. It gives every CVE a score from 0 to 1, plus a percentile ranking. FIRST says the scores are updated daily and are available through CSV files and an API. The FAQ says the scores are updated every day at 13:30 UTC.
How do you read an EPSS score and percentile?
- The score is a probability. FIRST gives an example: a score of 0.05 means a 5% estimated probability of exploitation activity in the next 30 days.
- The percentile is a relative rank. FIRST says a 5% probability currently sits around the 95th percentile, because most scores are close to zero.
Most scores sit close to zero. The FAQ explains that most vulnerabilities are never exploited, and says roughly 2.5 to 3 percent of published CVEs see exploitation activity in any 30-day window.
How is EPSS different from CVSS?
CVSS is the Common Vulnerability Scoring System, a way to describe how severe a vulnerability is. The FAQ says EPSS and CVSS measure different things. CVSS comes from expert judgment, while EPSS learns from real exploitation data. FIRST says the two are empirically uncorrelated, so a critical CVSS rating does not tell you the EPSS probability will be high.
How can teams use EPSS?
FIRST says EPSS helps security teams prioritize remediation by identifying which vulnerabilities are most likely to be exploited. FIRST states that there is no universal threshold. Teams should pick a threshold that fits their own capacity to fix issues and their tolerance for risk.
What does EPSS not tell you?
The FAQ says EPSS does not measure how much damage successful exploitation would cause, or whether it affects your environment.
Is EPSS the same as CVSS?
No. CVSS describes severity. EPSS estimates the chance of exploitation.
Does a high EPSS score mean we will be attacked?
Not necessarily. The score is a probability estimate, and the FAQ says it does not measure damage or whether a flaw affects your environment. It is one input for deciding what to fix first.
Also Called.
- NameEPSS
- Nameexploit prediction score
Questions.
-
What is EPSS?
The Exploit Prediction Scoring System is a model that estimates how likely it is that a published vulnerability will be exploited in the wild. FIRST describes it as the probability of exploitation in the next 30 days.
-
How is EPSS different from CVSS?
CVSS describes how severe a vulnerability is, based on expert judgment. EPSS estimates the chance of exploitation, learned from real exploitation data. FIRST says the two are empirically uncorrelated.
-
How often is EPSS updated?
FIRST says EPSS scores are updated daily and are available through CSV files and an API. Every CVE gets a score from 0 to 1 plus a percentile ranking.
-
Does a high EPSS score mean we will be attacked?
Not necessarily. The score is a probability estimate and does not measure damage or whether a flaw affects your environment. It is one input for deciding what to fix first.