An EPSS score is built from roughly 2,850 daily features per CVE, according to FIRST. They fall into groups: exploit code and tooling, chatter across security sources, vulnerability characteristics, and age plus reference volume. A separate set of exploitation data is used for training only, not for the daily score.
Feature group 1: exploit code and tooling
FIRST calls public exploit code one of the strongest signals in the model, but says EPSS asks what kind of exploit code, published where and how widely adopted. It contrasts carefully tested code operationalized in an exploit framework with a proof of concept pasted onto a personal blog. The model also tracks whether a CVE has been added to operational attacker tooling such as Nuclei templates, and to Shodan. FIRST adds that some of these signals follow attacker attention and others create it.
Feature group 2: chatter
EPSS records which security related domains mention a CVE and how recently. The sources named include security vendors, internet monitoring platforms, coordinated disclosure programs, informal channels where exploit code first appears, community aggregators and social platforms, and operating system advisories. Each domain is its own feature, and recency is captured with time bounded counts. Some sources lead exploitation, some lag it.
Feature group 3: what the vulnerability is
Here EPSS uses the individual CVSS metrics, such as attack vector, complexity, privileges required and user interaction, plus the impact metrics. It ignores the CVSS score itself, so the model learns its own weights instead of using the CVSS formula. It also derives tags from the description, such as remote code execution, and includes vendor and some product information. FIRST notes these features matter more for new CVEs, where other signals have not built up yet.
Feature group 4: age and references
Age contributes more to individual predictions than any other single vulnerability characteristic, FIRST says. Reference volume grows alongside age and reflects how much attention a CVE attracted.
What is not a daily input
Observed exploitation activity is the outcome the model is trained to predict. FIRST says it comes from nearly a dozen data partners across four source types: endpoint malware telemetry, honeypots, intrusion detection and prevention telemetry, and threat intelligence feeds and curated catalogs. These sources record attempts as well as successes. The FAQ states plainly that exploitation seen today does not directly change tomorrow's score.
Reading the groups as a practitioner
| Group | Helps most when | Weak spot |
|---|---|---|
| Exploit code and tooling | A mature module or template appears | Cannot tell if it works against your version |
| Chatter | Attention spikes after disclosure | Attention is not attack |
| Characteristics | A CVE is brand new | Coarse, the same for every deployment |
| Age and references | Old CVEs with a long record | Mechanisms are speculative, FIRST says |
None of these groups know your environment. FIRST says EPSS has no view of your assets or compensating controls. So the score is an input, not a verdict.
Practical takeaways
- A jump in a score usually means a new input arrived, such as exploit code or discussion. Go and look at which one. Searching for public code and advisories is a fast first step.
- A low score on a brand new CVE rests mainly on its characteristics, since little else exists yet. Re-check it as the days pass.
- Do not read the score as proof of attack. It is a forecast built partly from attention.
- Always add the local checks: is the component present, and can an attacker reach it.
Safeguard's reachability analysis and SBOM and dependency scanning cover those local checks for your code. You can try a free scan at gold.safeguard.sh/scan.
Quick check
Does EPSS use the CVSS score?
No. FIRST says it uses the individual CVSS metrics as features and ignores the score, so the model learns what weight each metric carries.
Does a recent attack raise tomorrow's EPSS score?
Not directly. FIRST says exploitation data informs training, not daily scoring. Score changes come from signals such as exploit code, discussion and references.
Sources
Last reviewed: 19 October 2026.
