EPSS Explained: Predicting Exploitation for CySA+ Vulnerability Management

EPSS — the Exploit Prediction Scoring System — estimates the probability that a given vulnerability will be exploited in the wild within the next 30 days. It exists because CVSS, for all its usefulness, answers a question that is not quite the one vulnerability managers need to answer.

CVSS tells you how bad a vulnerability would be if exploited. EPSS tells you how likely it is that anyone will bother.

Those are different questions, and conflating them is the single most expensive mistake in vulnerability management.

The Problem EPSS Solves

A typical enterprise scan returns thousands of findings, a large share of them rated High or Critical by CVSS. Patching all of them promptly is not possible, so teams work down the list by severity. The trouble is that severity is a poor predictor of what attackers actually use.

Only a small minority of published CVEs are ever exploited in the wild — consistently measured in the low single-digit percentages. Meanwhile, plenty of CVSS 9.8 vulnerabilities sit untouched for years because they require unusual preconditions, while a middling CVSS 7.5 in an internet-facing product gets mass-scanned within days of disclosure.

Prioritizing purely by CVSS therefore means spending most of your remediation effort on things nobody will attack, and that effort is not free — it is change windows, testing, and downtime you cannot spend elsewhere.

How EPSS Works

EPSS is a data-driven model maintained by FIRST, the same organization behind CVSS. It is trained on observed exploitation activity and produces, for each CVE, a probability between 0 and 1.

The model draws on signals including published exploit code, mentions in exploit frameworks such as Metasploit, the vendor and product affected, the vulnerability type, social media and security-community chatter, and observed scanning and exploitation telemetry from sensor networks.

Two numbers are published per CVE:

• The probability — an EPSS score of 0.85 means an estimated 85% chance of exploitation activity in the next 30 days.
• The percentile — where that score ranks against all other CVEs. A percentile of 0.97 means it is more likely to be exploited than 97% of known vulnerabilities.

Scores are recalculated daily, which matters: a vulnerability's EPSS score can jump sharply when proof-of-concept code is published. This is the property that makes EPSS operationally different from CVSS, which is essentially static once assigned.

Using It Properly

EPSS is not a replacement for CVSS. The two combine, and the combination is what exams and mature programmes expect.

	Low EPSS	High EPSS
High CVSS	Schedule normally — severe but not currently attractive to attackers	Patch immediately — severe and actively exploited
Low CVSS	Deprioritize	Investigate — widely exploited, and chained attacks matter

Add a third input and the picture is close to complete: asset context. A high-EPSS, high-CVSS vulnerability on an internet-facing production system outranks the same vulnerability on an isolated lab machine. Risk is threat times impact times exposure, and EPSS only supplies the first term.

EPSS and the KEV Catalog

CISA's Known Exploited Vulnerabilities catalog is the related artifact most often confused with EPSS, and the distinction is clean:

• KEV is observational and binary. A vulnerability is on the list because exploitation has been confirmed. It is authoritative but backward-looking, and the list is comparatively short.
• EPSS is predictive and probabilistic. It covers every CVE and estimates what is coming, at the cost of being an estimate.

Sensible practice: anything in KEV is patched on a mandatory timeline, and EPSS then prioritizes everything else. For US federal agencies, KEV remediation is a binding requirement under BOD 22-01.

Limits

EPSS predicts exploitation somewhere in the world, not exploitation of your environment. It says nothing about whether the vulnerable component is reachable, whether compensating controls are in place, or how valuable the asset is. It can also be wrong — a low score is a probability, not a guarantee, and targeted attackers do not consult it.

CySA+ (CS0-004) Exam Tips

• Know what EPSS predicts: likelihood of exploitation in the next 30 days, as a probability from 0 to 1.
• CVSS is severity; EPSS is likelihood. This contrast is the most likely question.
• Prioritization combines both, plus asset criticality and exposure. An answer using severity alone is incomplete.
• KEV is confirmed exploitation; EPSS is predicted. Know both and the difference.
• Scores update daily and move when exploit code is released.
• Most CVEs are never exploited, which is the premise of the whole approach.

Security+ and SecurityX Angles

Security+ (SY0-701) keeps it conceptual: vulnerability prioritization using threat intelligence rather than severity alone, and awareness of CVSS, CVE, and the general idea that not all vulnerabilities warrant equal urgency.

SecurityX (CAS-005) takes it to programme design — building a risk-based remediation policy with defined SLAs per tier, justifying deprioritization to auditors, and integrating EPSS and KEV feeds into vulnerability management tooling at scale.

Key Takeaways

• EPSS estimates the probability a vulnerability will be exploited within 30 days.
• CVSS measures severity; EPSS measures likelihood. They answer different questions and are used together.
• Scores are recalculated daily and react to published exploit code.
• KEV is confirmed and binary; EPSS is predicted and probabilistic.
• Add asset criticality and exposure to turn the two scores into an actual risk decision.
• The premise holds: only a small fraction of CVEs are ever exploited, so severity-only prioritization wastes most of your effort.

Related reading: SBOM · SCAP