EPSS scores are published daily, so a finding's priority can change without any change in your code. Use the score as one ranking input when a nightly rescan produces many findings, alongside known-exploited status and whether the code is reachable. Do not use it as a standalone gate.
What EPSS is
According to FIRST, the Exploit Prediction Scoring System is a model that estimates the probability that a published CVE will be exploited in the wild in the next 30 days. Scores run from 0 to 1, come with a percentile, and are published daily for every CVE. The data is free through CSV downloads, an API and a GitHub repository.
Note what it is not. It does not measure impact on your system, and it does not say whether the vulnerable code is used in your application.
Why daily matters for rescans
Severity from a base score is mostly fixed once published. EPSS moves. A CVE that looked unlikely last week can rise after exploit code appears. A nightly rescan that pulls fresh EPSS data will see that, while a pull request scan on the last merge will not.
Steps
- Join EPSS data to findings. Match on CVE ID after each rescan.
- Store the score with a date. You want to see the trend, not just today's number.
- Flag movers. Alert when a finding crosses a threshold you set, or jumps sharply. Choose the number from your own history, not from a blog.
- Combine signals. Rank with a simple table.
- Review the rule quarterly. Check what you would have missed.
| Signal | Question it answers |
|---|---|
| Known exploited listing | Is it being exploited now? |
| EPSS score and percentile | How likely is exploitation soon? |
| Reachability | Does my code call the vulnerable function? |
| Fix available | Can I act today? |
| Asset exposure | Is it internet facing? |
Limits
A low score is not proof of safety. EPSS is a probability, and rare events still happen. Also, scores exist for CVEs, so vulnerabilities without CVE IDs get no score. Treat missing as unknown, not as low.
Try it yourself
In the demo, see how an exploitability check changes the order of findings. Look at which signal moves an item up the list.
Click through it at your own pace, or open it full screen.
Quick check
Is EPSS the same as CVSS?
No. CVSS describes severity characteristics. EPSS estimates the chance of exploitation in the next 30 days.
Should I block builds on an EPSS threshold?
Be careful. It changes daily, so a build that passed yesterday could fail today for reasons unrelated to your change. Use it to rank work instead.
Sources
Last reviewed: 19 October 2026.
