EPSS looks forward and a patch time report looks back. EPSS gives the probability that a vulnerability will see exploitation activity in the next 30 days. A patch time report describes how long fixes took for a past set of flaws. Use EPSS to rank what to fix, and use reports to calibrate how fast you can fix.
Side by side
| Property | EPSS | Patch time report |
|---|---|---|
| Direction | Forward looking estimate | Backward looking measurement |
| Unit | Probability from 0 to 1 per CVE | Days, usually a median or average |
| Question | Which flaws are likely to be attacked soon | How long do organizations take to fix |
| Misuse | Treated as certainty | Treated as a target |
FIRST describes EPSS as providing a probability of observing exploitation activity in the next 30 days, along with a percentile that rank orders those probabilities (FIRST). The same article notes that the probability is the native output of the model, a value between 0 and 1.
How the two fit together
- Use the exploitation signals, EPSS and the CISA known exploited catalog (CISA), to decide which findings go first.
- Use your own patch time data, with a published report as context, to learn how long the first group takes you to fix.
- If the gap between the two is wide, work on the process, not on more scoring.
What not to do
- Do not read a patch time report as a prediction about a particular CVE.
- Do not read an EPSS score as a deadline. A low score is not a reason to ignore a flaw on an exposed system that is in your critical path.
- Do not multiply or blend the two into a single invented score.
An example decision
Suppose two findings have the same severity. One has a high EPSS percentile and is on the known exploited list. The other has a low score and no exploitation evidence. A published report says typical teams take a month to fix completed items. You do not need the report to decide the order: the first goes first. You need it, loosely, to ask whether you can fix the first one in days rather than weeks, and what blocks you if you cannot.
Where each one goes wrong
EPSS goes wrong when it is used as a verdict. A probability is not a prediction about a single event, and a low value does not mean safe. A patch time report goes wrong when it is used as a promise. Both are inputs, and the decision still belongs to the people who know your systems, your exposure and your change process.
Quick check
Is EPSS a patch deadline?
No. It is an estimate of exploitation likelihood for ranking. Deadlines come from your policy, exposure and exploitation evidence.
Can a patch report improve my EPSS use?
Indirectly. It helps you judge how fast a prioritized list can realistically be cleared, so you can fix the process if it cannot.
Safeguard supports this with continuous monitoring of your SBOM and dependencies, zero-day discovery, and policies and gates that you set yourself. The free scan at gold.safeguard.sh/scan is a quick way to see your own starting point.
Sources
- FIRST, Probability, percentile and bins of EPSS scores
- CISA, Known Exploited Vulnerabilities Catalog
Last reviewed: 19 October 2026.
