There is no official EPSS threshold. FIRST says the right one depends on your remediation capacity, risk tolerance and asset context. Choose by trading coverage of exploited vulnerabilities against the effort of fixing what the cutoff selects, then adjust over time. The commonly cited 0.10 carries no special authority from EPSS.
The tradeoff in one line
A lower threshold catches more of what eventually gets exploited, but you fix more things. A higher threshold means fewer fixes and more misses. FIRST calls this the coverage and effort tradeoff and says setting a threshold is a local exercise best done by trial and updating.
Start from what you do today
FIRST offers translations for teams moving off a CVSS-only workflow. Over the last 12 months about 61,000 CVEs were published, and just over 10 percent were rated CVSS Critical. Fixing at the 90th EPSS percentile, a probability of about 0.04, produces roughly the same size of work list, while selecting for flaws the threat data supports.
If you currently act on CVSS High and above, which FIRST puts at about the top 48 percent of published CVEs, the equivalent EPSS line is about 0.008.
These are starting points, and FIRST says explicitly that they are not an endorsement of the CVSS categories. They give you a like-for-like workload while you learn.
Do not anchor on intuition
A cutoff of 50 percent feels safe. FIRST calls it unrealistic. With a base rate near 2 percent, the top half of published CVEs are those above roughly 0.7 percent. A 50 percent line deprioritizes almost everything, about 98.8 percent of published CVEs by FIRST's figure. Even a score of 90 to 100 percent selects only about the top 0.2 percent.
Likewise, do not treat labels like "critical" or "high" as official. EPSS defines no bands. Any band is your risk tolerance written as a number.
A calibration routine
- Measure your capacity. How many findings can your team fix in a month without dropping other work? Use a real figure from past months.
- Pull your open findings with EPSS. Count how many fall above a few candidate lines, such as 0.01, 0.04 and 0.10.
- Pick the line whose count you can sustain. If 0.04 yields 300 findings a month and you can fix 120, move up or add a second filter.
- Add the overrides. KEV-listed findings go first regardless of EPSS. FIRST says to treat them as actively exploited. Unreachable or absent components drop down.
- Review each quarter. Re-count, and check which exploited flaws your line would have missed.
Use it as one filter, not the only one
FIRST names three checks to localize a score: presence, reachability and consequence. High EPSS on a package you do not run is noise. High EPSS on an unreachable code path is lower urgency. High EPSS on a critical system is where effort pays most.
So the final rule often looks like: KEV first, then above-threshold EPSS that is present and reachable, then everything else on a normal schedule. Write it down before the next alert.
Safeguard combines dependency scanning with reachability analysis, which covers the present and reachable checks.
Click through it at your own pace, or open it full screen.
Quick check
Is 0.10 the standard EPSS cutoff?
No. FIRST says it is commonly cited but has no special authority from EPSS. Calibrate against your own capacity.
Should a KEV-listed CVE with a low EPSS score wait?
No. FIRST advises treating a KEV entry as actively exploited and prioritizing it regardless of EPSS.
Sources
Last reviewed: 19 October 2026.
