EPSS is widely used and often misread. FIRST's documentation lists common misuses itself. Here are seven, each paired with what the documentation says is true: it is not a risk score, low does not mean safe, and recent attacks do not move it directly.
Myth 1: EPSS is a risk score
Fact: FIRST says EPSS provides only the threat likelihood component. It does not estimate impact, does not know your assets and does not account for compensating controls. Use it as one input, and add context. See turning a global score into a local decision.
Myth 2: A low score means the flaw is safe
Fact: FIRST lists this as a misuse. At 5 percent, about 1 in 20 similar vulnerabilities will see exploitation activity, and across thousands of CVEs that is many events. See does a low EPSS score mean a flaw is safe.
Myth 3: Multiply EPSS by CVSS for a combined risk
Fact: FIRST says EPSS is a calibrated probability and CVSS is an ordinal ranking by expert judgement with no empirical calibration, so the product has no interpretable meaning. See never multiply EPSS by CVSS.
Myth 4: A confirmed attack should push the score to 100 percent
Fact: FIRST says exploitation activity trains the model but is not used in daily scoring, and that a score of 1.0 would mean certain exploitation in every future 30 day period. If you have direct evidence of exploitation, that evidence should take precedence over the score. KEV is the place to look.
Myth 5: Judge the model by one CVE
Fact: FIRST says a single data point says nothing about a system scoring hundreds of thousands of CVEs daily. Look at the system against the alternatives, using coverage, effort and efficiency.
Myth 6: Pick a threshold that feels right
Fact: FIRST says anchoring on intuition, such as treating 50 percent as the top half, produces unrealistic thresholds. The base rate is around 2 to 3 percent, and the top half of CVEs sits above roughly 0.7 percent. It also says there is no universal threshold and that the commonly cited 10 percent has no special authority from EPSS. See choosing a threshold.
Myth 7: I do not trust predictions, so I will ignore it
Fact: FIRST argues that rules like patch all KEV or patch all CVSS Critical also make a predictive claim about future exploitation, and that EPSS states its claim explicitly and measures it. You can judge that argument yourself, and note that it comes from the maintainers. A fair test is to run your own backlog both ways and compare which flagged items turned out to matter.
Summary table
| Myth | Better statement |
|---|---|
| It is a risk score | It is the likelihood input |
| Low means safe | Low means unlikely, not impossible |
| Multiply by CVSS | Keep them separate |
| Attacks should show at once | Training data, not daily input |
| One CVE proves it wrong | Judge across many |
| Choose a round number | Calibrate to capacity |
| Predictions are useless | Every rule predicts, test it |
Where Safeguard fits
Whatever signal you use, the local checks stay yours. Safeguard's reachability analysis, SBOM and dependency scanning and policy gates handle presence, usage and enforcement. You can try a free scan at gold.safeguard.sh/scan.
Quick check
Who writes EPSS?
FIRST says EPSS is maintained by the EPSS Special Interest Group at FIRST, with scores generated by Empirical Security and published freely.
Is there a correct EPSS threshold?
No. FIRST says the right threshold depends on remediation capacity, risk tolerance and asset context, and that a commonly cited 10 percent carries no special authority.
Sources
Last reviewed: 19 October 2026.
