Every vulnerability percentage should show its count, its denominator and its snapshot date, such as "17,321 of 390,807 scored CVEs (4.4 percent) had an EPSS of 0.1 or higher on 18 October 2026". A bare percentage cannot be checked, and a different denominator changes the story completely.
The same number, three denominators
Take the EPSS file scored on 18 October 2026. It had 390,807 rows, and 17,321 of them had a probability of 0.1 or higher. As a share of all rows that is 4.4 percent.
Now change the question slightly. KEV release 2026.10.16 has 1,748 entries, and 1,747 of them had an EPSS row. A statement such as "most KEV entries score above 0.1" needs its own count and its own denominator (1,747, not 1,748 and not 390,807). The two shares are not comparable unless you say what each counted.
Each number can be right and the sentence still misleading, because the reader assumes one population while you used another.
A format that works
Use "n of N (p percent), as of date". Round the percentage to one decimal and state what it is a share of.
| Weak | Strong |
|---|---|
| 4% of CVEs are high EPSS | 17,321 of 390,807 CVEs (4.4%) scored at or above 0.1 on 2026-10-18 |
| Most KEV entries are old | State the age rule and the n, for example by dateAdded year |
| Few advisories have severity | 11,336 of 26,383 PyPI records (43.0%) carry a severity entry |
For small groups, show the raw count only. Percentages from tiny groups look precise and are not. A share of 100 percent from three records tells a reader very little.
Steps before you publish
- List every percentage in the draft.
- Beside each, write n and N.
- Check that N is the same population the sentence describes.
- Check that n and N come from the same snapshot.
- Decide how to handle missing rows. See Unknown is not No.
- Make sure the table total matches the text.
Common traps
- Mixing a catalog total with a joined subset.
- Reporting a share of entries and calling it a share of vulnerabilities, when one vulnerability can have several rows.
- Rounding in the middle of a calculation. Round at the end.
- Using last month's N with this month's n.
- Calling a snapshot share a "rate". A rate needs a time base.
A related caution: when you add or compare probabilities, be careful what the sum means. See adding up EPSS scores.
A worked example, three honest sentences
Using the files fetched on 19 October 2026, here are three statements that could all appear in one post, each with its own denominator.
- "17,321 of 390,807 scored CVEs (4.4 percent) had an EPSS of 0.1 or higher on 18 October 2026." The population is every CVE in the EPSS file.
- "1,747 of 1,748 KEV entries (99.9 percent) had an EPSS row." The population is KEV entries.
- "11,336 of 26,383 PyPI records in OSV (43.0 percent) carried a severity entry." The population is PyPI records in the export.
The percentages cannot be compared with one another. Putting them in a single chart would imply they could. A reader skimming a chart with three bars at 4.4, 99.9 and 43.0 would assume they measure the same thing.
Arithmetic you can check
To verify the first figure yourself, divide 17,321 by 390,807. The result is about 0.0443, or 4.4 percent. For the third, divide 11,336 by 26,383 to get about 0.4297, or 43.0 percent. If your own division does not match, your files differ from the ones described, and you should check the snapshot first.
Small groups
Percentages from small groups mislead. If a category holds six rows out of 1,748, report six and the total, and avoid a percentage with three decimals. A rule of thumb is to show counts alone whenever the group is small enough that one row would move the percentage visibly. Do not describe a result as a trend from a handful of rows.
| Group size | How to report |
|---|---|
| Large | Count, denominator, percent to one decimal |
| Medium | Count and denominator, percent optional |
| Small | Count and denominator only |
Charts
A chart axis should say what it counts. "Share of KEV entries" is acceptable only if the denominator is in the caption. When you use stacked bars, the bars should sum to the denominator you state, and the legend should include a category for missing values. If the bars do not sum to the stated total, readers will notice and wonder what you removed. For presenting numbers to executives, see how to report KEV exposure to leadership.
A closing check
Before publishing, pick three numbers at random from your post and rebuild each from the frozen files in under five minutes. If you cannot, the post is not ready.
A pre-publication table
Make one table for yourself before you publish. It never goes in the post.
| Figure in the post | n | N | Snapshot | Population |
|---|---|---|---|---|
| 4.4 percent | 17,321 | 390,807 | EPSS 2026-10-18 | Scored CVEs |
| 99.9 percent | 1,747 | 1,748 | KEV 2026.10.16 | KEV entries |
| 43.0 percent | 11,336 | 26,383 | OSV PyPI export | PyPI records |
If any row has a blank cell, the figure is not ready. This table takes five minutes to fill and prevents most denominator errors.
Try it yourself
Click through it at your own pace, or open it full screen. Watch how totals shift as you change the filter.
Quick check
Is a percentage ever fine without counts?
In a headline, maybe. In the body or a chart note, give n and N.
How many decimals should I show?
One is usually enough. More digits suggest precision the snapshot does not have.
Is it wrong to quote a rounded percentage in a headline?
No, as long as the body gives the count and denominator. Make sure the rounded figure matches the table.
Sources
- EPSS daily scores file, model v2026.06.15, score date 2026-10-18T12:03:10Z, https://epss.empiricalsecurity.com/epss_scores-current.csv.gz (fetched 19 October 2026; computed by the author).
- CISA KEV JSON feed, catalogVersion 2026.10.16, https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json (fetched 19 October 2026).
- OSV PyPI export, https://osv-vulnerabilities.storage.googleapis.com/PyPI/all.zip (fetched 19 October 2026; computed by the author).
Last reviewed: 19 October 2026.
