Use the EPSS API when you need the current score for one CVE or a small batch, such as enriching a ticket. Use the daily CSV when you want scores for everything, such as loading a database or joining an asset inventory. FIRST says the API should not be used to keep a full local copy.
The two access paths side by side
| Question | API | Daily CSV |
|---|---|---|
| Best for | Lookup of one CVE or a few | Bulk loads and joins |
| Typical use | Enrich an incoming ticket or script | Fill a database or dashboard |
| History | Date parameter and 30-day time series | Archive of daily files on GitHub |
| Registration | None | None |
| Cost | Free | Free |
Both are free and need no registration, according to FIRST. Attribution is requested when you publish EPSS data in a product or paper.
What the CSV contains
The file has three fields for every scored CVE: the CVE ID, the EPSS probability between 0 and 1, and the percentile, which FIRST defines as the proportion of all scored vulnerabilities with the same score or lower. From v2 onward the first line is a comment that names the model version and the publish date, so skip it when parsing.
The current file sits at one stable address, and the page notes that the address redirects. That is why the sample command uses the follow-redirects flag.
curl -sL https://epss.empiricalsecurity.com/epss_scores-current.csv.gz | gunzip -c | head -3
When the file lands
FIRST's FAQ says scores are published daily, typically within a minute or two after 13:30 UTC. If your job runs at midnight, you are reading the previous day's file. Schedule your pull for the afternoon UTC, then add a check: compare the date in the header line with today's date, and alert if they differ for more than a day.
A simple pipeline
- Pull the CSV once a day after the publish time.
- Read the header comment and store the model version.
- Load the rows into a table keyed by CVE.
- Join the table to your list of CVEs found in your own estate, so you score only what you have.
- Use the API for exceptions: a ticket arrives with a CVE that is not yet in your table, or a person wants a 30-day trend.
Avoid the tempting shortcut of calling the API once per CVE for the whole estate. FIRST describes the API as designed for lookup, not bulk access. A daily file is lighter on the service and gives you a stable snapshot, so every report that day uses the same numbers.
Keep snapshots
Because scores change daily, keep each day's slice for your inventory, or at least the days you made decisions. You can always fetch history from the archive, but a local copy saves a lookup and records exactly what your dashboard showed. If the model version changes, your stored header line tells you why a day looks different. See why a score history jumps when the model changes.
Where Safeguard fits
EPSS tells you about the world, not your estate. Safeguard's SBOM and dependency scanning list which packages you actually run, and reachability analysis helps show whether the vulnerable code is used. You can try a free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at the inventory view. That list of packages is the left side of the join you would run against the EPSS file.
Quick check
Is the EPSS API free?
Yes. FIRST says scores are published free by CSV and API, with no registration required, and asks for attribution when the data is used in publications or products.
What time does EPSS publish new scores?
FIRST's FAQ says daily, typically within a minute or two after 13:30 UTC.
Sources
Last reviewed: 19 October 2026.
