Use EPSS in a leadership report as a ranking aid, shown next to known exploitation status and reachability, with the date the scores were taken. It is a probability that a CVE will be exploited in the next 30 days, not a measure of damage or of your specific exposure.
What EPSS is
FIRST describes EPSS as an estimate of the probability that a published CVE will be exploited in the wild within the next 30 days. It publishes a probability between 0 and 1, along with a percentile, daily, for every CVE. It is built from observed exploitation data rather than subjective judgment.
That makes it useful for ordering a large list. It does not tell you the impact on your business, whether the vulnerable code is reachable, or whether your version is even affected.
How to present it
| Do | Avoid |
|---|---|
| Show EPSS next to KEV listing status | Presenting it as the risk score |
| Say "estimated probability of exploitation in 30 days" | Saying "likelihood of being hacked" |
| Date the scores, since they change daily | Quoting a score with no date |
| Use bands such as high, medium, low from a stated threshold | Showing six decimal places |
| Combine with reachability and asset importance | Ranking only by EPSS |
A simple reporting pattern
- List findings known to be exploited (from the CISA KEV catalog) first.
- Among the rest, list reachable findings sorted by EPSS.
- Show asset importance as a column.
- Show the count of findings above your chosen EPSS threshold, with the threshold written out.
State that thresholds are your policy choice. FIRST publishes the scores, and what cut off to use is your decision.
Probability versus percentile
A percentile says how a CVE ranks compared with others, while a probability says how likely exploitation is. Many CVEs have low probabilities, so a decent percentile can still be a small absolute number. Pick one to show, label it clearly, and use the same one every time.
Pitfalls
- Scores move. A finding can jump when exploit code appears, so refresh daily or on each scan.
- A low score is not safety. New or niche issues may be scored low until activity appears.
- Leaders may read 0.05 as "5 percent chance we are breached". Add a plain sentence of explanation to the first report.
Try it yourself
Open the demo and look at how exploitability signals are shown beside each finding. Consider which ones you would put in a leadership view.
Click through it at your own pace, or open it full screen.
Safeguard supports this with reachability analysis and vulnerability tracking, and you can run a free scan at gold.safeguard.sh/scan.
Quick check
Can EPSS replace CVSS?
They answer different questions. CVSS describes severity, EPSS estimates exploitation probability. Use both with context.
How often should EPSS values be refreshed?
FIRST publishes daily, so refresh on each scan and date every figure.
Sources
Last reviewed: 19 October 2026.
