Read the EPSS probability when you want an absolute estimate of exploitation in the next 30 days, and the percentile when you want to know how a CVE ranks against all others. Both come from one model. Because most CVEs score near zero, a probability that looks small, such as 5 percent, can still sit in the top 10 percent.
What each number means
EPSS publishes two values for every scored CVE each day.
The probability is a number from 0 to 1. FIRST describes it as the estimated likelihood that exploitation activity will be observed by its data partners within the next 30 days. A score of 0.05 means that among many CVEs around 0.05, about 1 in 20 would be expected to show exploitation activity.
The percentile is the share of all scored CVEs with the same or a lower score. A CVE at the 90th percentile scores higher than 90 percent of the others.
The percentile is only a transformation of the probability. Nothing new is added.
Why a small probability can be a high rank
Exploitation is rare. The EPSS FAQ says that in any 30 day window it observes exploitation activity for roughly 2.5 to 3 percent of published CVEs, and that the CISA KEV catalog lists roughly 0.5 percent. So the whole distribution is squeezed toward zero.
FIRST gives concrete anchors. A probability of 0.10 currently sits around the 95th percentile. A 5 percent score ranks in the top 10 percent of published vulnerabilities, against a base rate around 2 to 3 percent. The mean score is around 2.8 percent and the median around 0.7 percent.
If you read 0.05 the way you read a school grade, it looks trivial. It is not.
When to use which
- Use probability for math: expected counts, program level exposure, cost and benefit comparisons, and calibration checks. It behaves like a probability.
- Use percentile for human conversations and for setting a cut line such as "top 10 percent", because ranks are easier to reason about than tiny decimals.
Whichever you choose, say which one in the ticket or the dashboard. "EPSS 0.9" is ambiguous if the reader assumes the other scale.
Common misreadings
- A 0.5 cutoff is sensible. It is not. With a base rate near 2 percent, a 50 percent line ignores nearly all published CVEs, including many that will be exploited.
- Near zero means a data gap. FIRST says a score near zero is a prediction, not a missing value.
- Higher means more damage. EPSS says nothing about impact. It does not know your environment.
A practical default
Store both numbers with the date. Sort by percentile for a quick glance, but make any automated rule on the probability, because it has a stable meaning. Then combine with presence, reachability and consequence in your own estate, which FIRST names as the three checks that turn a population score into your decision.
Safeguard's reachability analysis addresses the second of those checks, whether the vulnerable code is actually used in your application. The free scan is at gold.safeguard.sh/scan.
Quick check
Is a 10 percent EPSS probability low?
Not by rank. FIRST says 0.10 currently sits around the 95th percentile, because most CVEs score near zero.
Is the percentile a different model output?
No. It is a transformation of the probability that ranks it against all currently scored CVEs.
Sources
Last reviewed: 19 October 2026.
