No. A low EPSS score means a vulnerability looks like the large majority that are never exploited in the next 30 days. It does not mean it is harmless, absent from attackers' tools, or unaffected by your exposure. Treat it as a reason to wait, not a reason to forget.
Myth: a small number means no risk
Fact. FIRST's guidance lists "thinking small probabilities are safe" as a common misuse. A 5 percent score across thousands of CVEs still corresponds to many exploitation events, since about 1 in 20 would be expected to show activity. And 5 percent ranks in the top 10 percent of all scored CVEs.
Myth: near zero means EPSS has no data
Fact. The FAQ says a score near zero is a prediction, not a data gap. Most scores cluster near zero because most vulnerabilities are never exploited. FIRST notes that roughly 2.5 to 3 percent of published CVEs show exploitation activity in a given 30 day window, so a model should give low scores to the large majority.
Myth: if it is on KEV, EPSS must be high
Fact. The two answer different questions. KEV records confirmed exploitation in the past. EPSS forecasts the next 30 days. FIRST says a low EPSS score on a KEV-listed CVE is not a contradiction. KEV may be recording an isolated incident, while EPSS reflects the broader pattern.
The rule of thumb in FIRST's guide is clear: when a CVE appears on KEV, treat it as actively exploited regardless of EPSS. Recent exploitation is a strong signal of near term exploitation. That signal fades with time if nothing else supports it, so an entry added years ago drifts back toward what its features predict.
Myth: EPSS will warn me when an attack starts
Fact. Exploitation activity trains the model but does not feed daily scoring, so a score does not jump because of yesterday's headline. If you hear about active exploitation from a vendor or from CISA, act on that.
Myth: judge EPSS by one example
Fact. FIRST warns against judging a model from a single score. One CVE that scored low and was later exploited says little about a system that scores hundreds of thousands of CVEs a day. The fair comparison is against the alternatives, such as patching only CVSS Critical, which also miss things.
What a low score is good for
A low score is a fair basis for scheduling. A flaw with a low score, no KEV entry, no reachable code path and a normal fix available can go into the regular patch cycle. That frees time for the work that matters now.
It is not a basis for closing the ticket with no review. Set a rule that low-scoring findings get a re-check when the score rises, when a KEV entry appears, or when the component's exposure changes.
A defensible policy line
"Findings below our EPSS line, not on KEV, and not reachable are scheduled with standard updates. They are rechecked daily for changes in score or KEV status."
Safeguard watches for those changes across your inventory, and its policies and gates can hold the line in the pipeline. The free scan is at gold.safeguard.sh/scan.
Quick check
Can a KEV-listed vulnerability have a low EPSS score?
Yes. KEV is a record of confirmed exploitation, while EPSS is a forecast. FIRST advises treating a KEV entry as actively exploited regardless.
Is it safe to close findings below my EPSS line?
Schedule them rather than close them, and re-check when the score, KEV status or exposure changes.
Sources
Last reviewed: 19 October 2026.
