How EPSS works

EPSS combines information about each CVE, such as the type of weakness, vendor, availability of exploit code and references in security tools, with observed exploitation activity. A machine learning model turns this into a probability. Each score also comes with a percentile showing how it ranks against all other scored vulnerabilities.

EPSS vs CVSS vs KEV

  • CVSS measures how severe a vulnerability would be if exploited.
  • EPSS estimates how likely it is to be exploited soon.
  • CISA KEV confirms that it has already been exploited.

Used together, they give a strong prioritisation signal: fix KEV-listed issues first, then those with high EPSS and high CVSS on exposed systems.

Limits of EPSS

EPSS predicts exploitation across the whole internet, not against your organisation specifically. It does not know which assets you expose or how important they are, so it works best alongside asset context such as whether the system is internet-facing and what data it holds.

How DarkInvader helps

DarkInvader combines severity, exploitation evidence and asset exposure when prioritising findings on your external attack surface, so the vulnerabilities attackers are most likely to use against your exposed systems are fixed first.

Explore Vulnerability Scanning

Frequently asked questions

Is EPSS free to use?

Yes. FIRST publishes EPSS scores for all published CVEs free of charge, with a daily data file and an API.

What is a good EPSS threshold?

There is no single right number. Many teams treat scores in the top few percentiles as urgent, but the threshold should reflect how much remediation capacity you have and how exposed the affected systems are.

Does a low EPSS score mean a vulnerability is safe?

No. It means exploitation is less likely in the near term across the internet. Targeted attackers may still use it, and scores change as new exploit code appears.

Related terms and reading

Sources