Show the probability when you need a likelihood of exploitation activity, and the percentile when you need to rank against all scored vulnerabilities. Label which one you display. They are not interchangeable: because most scores sit near zero, a modest probability can already be a high percentile.
What EPSS says it is
FIRST's EPSS FAQ explains that the score ranges from 0 to 1, or 0 to 100 percent, and estimates the likelihood that a data partner's sensors will detect and share evidence of exploitation activity for a vulnerability, in the next 30 days. A score of 0.95 means a 95 percent estimated probability of observed exploitation activity in that window.
It also says plainly that EPSS does not account for context such as compensating controls or factors specific to your environment. A complete risk calculation combines the probability with environmental context and likely impact.
Probability versus percentile
| Probability | Percentile | |
|---|---|---|
| Meaning | Absolute chance of observed exploitation activity in 30 days | Position relative to all scored vulnerabilities |
| Use | Thresholds, expected counts, cost benefit | Quick ranking and triage lists |
| Risk | Seems small when it is not | Seems precise when it is relative |
The FAQ gives an example of the skew. Because the distribution is heavily weighted toward zero, since most vulnerabilities have no observed exploitation activity, a probability of 0.10 currently sits around the 95th percentile. A reader seeing "10 percent" might shrug, while "95th percentile" sounds alarming, yet they describe the same item.
Dashboard rules
- Label the field. Write "EPSS probability" or "EPSS percentile", never just "EPSS".
- Show the date. Scores update, so a stale value misleads. Show when it was fetched.
- Do not average it. A mean probability across findings has no clear meaning.
- Set thresholds on probability. It has stable properties for downstream work, as the FAQ notes about expected counts and threshold analysis.
- Use percentile for sorting. It is easy to read in a ranked list.
- Pair it with context. Add reachability, exposure and known exploited status.
What EPSS does not replace
EPSS predicts exploitation activity across the population. It does not say whether the vulnerable code runs in your application, whether the asset is exposed or what it would cost you. Reachability analysis and asset context fill those gaps. A known exploited listing, such as CISA's catalog, is separate evidence that exploitation has been observed.
A simple triage use
Combine three signals per finding: known exploited yes or no, EPSS probability above your chosen threshold or not, and reachable or not. Set the response window by the combination. Document the thresholds and review them on a schedule.
Pitfalls
- Treating a low score as safe forever. Scores change.
- Comparing probability across different dates.
- Hiding the 30 day window in the tooltip. Put it in the label.
Safeguard offers SBOM and dependency scanning, reachability analysis and policy gates. You can run a free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Click through the exploitability signals and note which questions each one answers.
Quick check
Is a 0.10 EPSS probability low?
It means about a 10 percent estimated chance of observed exploitation activity in 30 days, and per FIRST that currently sits near the 95th percentile.
Can EPSS stand in for a risk score?
No. FIRST says it lacks organisational context and should be combined with impact and environment.
Sources
Last reviewed: 19 October 2026.
