Prioritization
EPSS explained: what the score means and when to trust it
EPSS estimates the chance a CVE is exploited in the next 30 days. What the score and percentile mean, where EPSS falls short, and how to use it with KEV.
Varaxon Technologies · · 2 min read
What EPSS is
The Exploit Prediction Scoring System (EPSS) is run by FIRST, the Forum of Incident Response and Security Teams. Every day it scores published CVEs with the estimated probability that exploitation activity will be observed in the next 30 days.
It is built from real-world signals such as observed exploitation attempts, public exploit code and how the vulnerability is described, and it is free to use through FIRST's website and API.
Score vs percentile
| You see | It means |
|---|---|
| Score 0.42 (42%) | An estimated 42% chance of exploitation activity in the next 30 days. |
| Percentile 0.98 (98%) | This CVE scores higher than 98% of all scored CVEs. |
| Score under 1% | Typical. Most CVEs sit here, which is why a high score stands out. |
The two numbers answer different questions. The score is an absolute chance; the percentile is a ranking. A score of 5% can still be in the top few percent of all CVEs because so many score close to zero.
Where EPSS falls short
- It changes daily. That makes it a good live signal but a poor basis for a fixed ranking a client signs off on.
- It knows nothing about your environment. An internet-facing server and an isolated lab machine get the same score.
- It only covers CVEs. Misconfigurations and findings without a CVE have no EPSS score.
- A low score is not a clean bill of health. It is an estimate, and new or targeted exploitation can appear before the model catches up.
How to use EPSS with KEV and CVSS
- Fix anything on CISA KEV first, ransomware-linked entries before the rest. See what CISA KEV is.
- Among the rest, use EPSS to pull forward findings that are likely to be exploited soon.
- Use CVSS for impact, and your own knowledge of which systems matter most.
Check any CVE's EPSS score, KEV status and CVSS severity together with the free CVE checker. Varaxon Scan Hub shows EPSS beside every finding in a report and never lets a missing or low EPSS score move a finding down a band.
Common questions
What is a good EPSS score threshold?
FIRST does not set one. Teams pick a threshold based on how many findings they can handle; a common starting point is treating scores of 10% or more as urgent, alongside everything on CISA KEV.
Is EPSS better than CVSS?
They measure different things. CVSS rates how bad exploitation would be; EPSS estimates how likely it is soon. Use both, with CISA KEV ahead of either.
Is EPSS free?
Yes. FIRST publishes daily EPSS scores for free, with a public API and downloadable data.
Turn your next scan export into a client-ready report.
Run a free pre-flight check