Multiplying an EPSS score by a CVSS score looks like probability times severity, but it produces a number with no meaning. EPSS is a calibrated probability. CVSS Base is an ordinal ranking set by expert judgment. FIRST warns against the combination and calls it score laundering. Use the two as separate filters instead.
Why it is tempting
Risk is often described as likelihood times impact. EPSS is a likelihood. CVSS sounds like an impact. Multiply them, sort, and you have a single risk column. Many spreadsheets and some dashboards do exactly that.
Why it fails
Three problems, all from FIRST's own pages.
- CVSS Base is not an impact measure. The CVSS v4.0 documents say the Base score measures severity, and that it should not be used alone to assess risk. Severity here is a ranking of how bad the technical characteristics are.
- The scales are different kinds of thing. EPSS is a calibrated probability, tested against what actually happened. CVSS Base is an ordinal ranking produced by experts. FIRST says the product of a calibrated probability and an ordinal ranking is no longer a probability and has no interpretable meaning.
- The CVSS part adds noise. The EPSS FAQ says the CVSS component contributes nothing beyond distorting the original score in proportion to expert opinion. It also notes that EPSS already uses the individual CVSS metrics as model inputs, so the useful part of CVSS is in there.
What looks wrong in the output
Take two flaws. One has a high likelihood and a modest severity. The other has a low likelihood and a maximum severity. Multiplication can rank them as equals, which hides the fact that one is probably under attack and the other probably is not. The sorted list feels precise and is not.
What to do instead
Keep signals separate and combine them with rules that you can explain.
- Exploitation evidence first. If a flaw is on the KEV catalog, treat it as actively exploited. FIRST advises this regardless of EPSS.
- Likelihood second. Filter by an EPSS probability or percentile line that matches your remediation capacity.
- Context third. Check presence, reachability and consequence in your own environment.
- Severity as a tiebreaker. Use the CVSS vector, the vendor's Provider Urgency or Automatable values when present, to order flaws inside a tier.
A decision tree such as SSVC is built for exactly this. It maps discrete decision points to an action, with no pretend arithmetic. CISA's version ends in four outcomes: Track, Track*, Attend and Act.
If you need a number
When leadership wants one score, two honest options exist. Report counts per tier, for example how many KEV, how many above the EPSS line and reachable, and how many open. Or report the expected number of exploited flaws, computed by summing EPSS probabilities, which FIRST describes as valid for calibrated probabilities. Neither pretends to be risk in dollars.
Safeguard keeps severity, reachability and fix availability as separate fields on each finding, so you can build tiers without inventing a composite score. The free scan is at gold.safeguard.sh/scan.
Quick check
Is EPSS times CVSS a legitimate risk score?
No. FIRST says multiplying a calibrated probability by an ordinal ranking has no interpretable meaning.
What can I do instead of a combined score?
Use tiered rules: KEV first, then likelihood above your line, then reachability and asset context, with severity as a tiebreaker.
Sources
- FIRST: EPSS Frequently Asked Questions
- FIRST: Using EPSS
- FIRST: CVSS v4.0 User Guide
- CISA: Stakeholder-Specific Vulnerability Categorization
Last reviewed: 19 October 2026.
