According to FIRST, remediating at about the 90th EPSS percentile, a probability near 4 percent, produces roughly the same number of CVEs as a CVSS Critical filter. A CVSS High and above filter is about 0.8 percent. Treat these as a starting point for migration, not a target.
Where the equivalence comes from
FIRST's Using EPSS page offers translation points for teams that act on CVSS today. It says that over the last 12 months there were about 61,000 CVEs published, and just over 10 percent received a Critical rating. Acting on the 90th percentile of EPSS, a score of at least 0.04, selects a similar number of CVEs. It adds that the translation is a starting point and not an endorsement of the CVSS categories.
| Current rule | Rough EPSS equivalent by effort |
|---|---|
| CVSS Critical only | About the 90th percentile, 0.04 or 4 percent |
| CVSS High and above, about the top 48 percent | Around 0.008, or 0.8 percent |
The word equivalent here means equal workload. The selected CVEs differ, because EPSS uses exploitation data and CVSS uses expert judgement. FIRST's argument is that for the same effort you target CVEs the threat data supports.
How to migrate in five steps
- Count the findings your team currently treats as urgent, for one month.
- Look up the EPSS probability for each. FIRST's coverage and effort framework is the method to tune with.
- Pick the EPSS line that gives the same count as today. Start near the 90th percentile.
- Run both rules side by side for a cycle. List the findings that only one rule would have flagged.
- Review those differences with an engineer. Ask whether the extra EPSS findings are present and reachable, and whether the findings only CVSS flagged have any exploit signal.
What will differ
Expect some CVSS Critical findings to fall below the EPSS line, and some Medium findings to rise above it. That is the point of the exercise. FIRST notes that CVSS and EPSS measure different things and are empirically uncorrelated: a critical severity score means a practitioner would consider the flaw bad, while a low EPSS score means exploitation is unlikely given current signals. Both can be true.
Guard rails to keep
- Keep KEV as an override. A CVE on the CISA KEV list has confirmed exploitation, and FIRST says to follow KEV when it conflicts with a low EPSS score.
- Keep an escape route for severe flaws in internet facing code that have no exploit signal yet. EPSS is a forecast, and a new CVE has sparse data.
- Do not multiply EPSS by CVSS. FIRST calls this score laundering and says the product has no interpretable meaning. See why you should not multiply them.
- Re-check the line after each model version change, since probabilities can shift.
Explaining the change to stakeholders
Say it plainly: we kept the workload about the same and changed which items we pick, using evidence of real exploitation instead of a severity label. Show the side by side list from step 4. Concrete examples persuade better than methodology.
Safeguard's policies and gates can enforce whichever thresholds you decide on, and reachability analysis adds the check on whether vulnerable code is used. You can try a free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how a gate decides to pass or block, and consider which of your thresholds would sit in that rule.
Quick check
Is the 90th percentile an official EPSS recommendation?
No. FIRST presents it as a translation for programs moving away from a CVSS Critical filter, based on matching workload. EPSS itself sets no universal bands.
Should I drop CVSS entirely?
Not necessarily. CVSS describes severity and impact. Many teams keep it for impact context and use EPSS and KEV for likelihood.
Sources
Last reviewed: 19 October 2026.
