Yes, as one input. FIRST says EPSS supplies the threat likelihood component, the probability of observed exploitation in the next 30 days. It does not cover your controls, your susceptibility or impact. In a register, cite it as the attacker activity input, and add your own context for the rest of the likelihood.
What FIRST says the mapping is
The Using EPSS page includes a table that relates EPSS to common risk methods. A short version follows, in FIRST's framing.
| Method | Term | What EPSS informs |
|---|---|---|
| FAIR | Threat Event Frequency | Observed attacker action, not your control strength |
| NIST SP 800-30 | Likelihood determination | The attacker activity half; your controls and susceptibility are the other half |
| NIST CSF 2.0 | ID.RA-04 and ID.RA-05 | The likelihood input to vulnerability prioritization, with CSF deferring its method to SP 800-30 |
| ISO 27005:2022 | Threat likelihood | Observed exploitation activity, not vulnerability exploitability |
| OWASP Risk Rating | Likelihood, threat agent factors | Not ease of discovery or awareness |
These mappings are FIRST's own reading, so cite them as such. They are not statements by NIST, ISO or OWASP.
How to write the entry
A good register row for a vulnerability names each part of the reasoning.
- Threat activity: EPSS probability and percentile, with the date and model version, and whether the CVE is on KEV.
- Susceptibility: is the component present, which version, is the vulnerable code reachable.
- Controls: network exposure, authentication and compensating controls in place.
- Impact: what the system holds or does.
- Decision: treat, mitigate, transfer or accept, with owner and review date.
Recording the date matters, because the score changes daily. See epss score on a past date.
What not to write
- Do not write that EPSS is the risk score. FIRST says EPSS is part of a risk calculation and omits impact, assets and controls.
- Do not multiply EPSS by CVSS to get a combined number. FIRST says that has no interpretable meaning.
- Do not call a low score a guarantee. FIRST says a low score does not make a flaw safe.
- Do not claim it satisfies an audit requirement by itself. FIRST says auditors typically accept likelihood methods on framework alignment and documentation, so your documentation is what counts, and it should be yours.
Aggregating across a register
Because EPSS is a calibrated probability, FIRST describes ways to combine scores, such as summing them for an expected count of exploited vulnerabilities. See adding up EPSS scores for how to do it. Treat the result as an estimate to track over time, not a forecast to publish as fact.
For a small team
If a spreadsheet is your register, add four columns: EPSS, percentile, KEV yes or no, and reachable yes or no. Fill them on a fixed day each week. That is enough to show a reviewer a repeatable method.
Safeguard's compliance and evidence automation can keep the supporting records together, and reachability analysis supplies the susceptibility check. You can try a free scan at gold.safeguard.sh/scan.
Quick check
Is EPSS a complete likelihood estimate?
No. FIRST says it informs the attacker activity part. Susceptibility and existing controls come from your own assessment.
Does EPSS measure business impact?
No. FIRST says it does not estimate impact, know your assets or account for compensating controls.
Sources
Last reviewed: 19 October 2026.
