EPSS is a probability, from 0 to 1, that a vulnerability will be exploited in the wild in the next 30 days, based on observed data. It is not a risk score: it says nothing about your systems or the damage an attack would cause. Managers should read it as a hint about urgency.
What the number is
FIRST, which publishes EPSS, says it estimates the probability a vulnerability will be exploited in the wild within the next 30 days (FIRST EPSS FAQ). A score of 0.02 means about two percent. A score of 0.90 means about ninety percent.
It is forward-looking and it is a prediction, not a measurement of something that already happened. It is also narrower than it sounds: the FAQ describes it in terms of exploitation evidence that data partners can detect and record, so it covers exploitation they can observe.
What it does not tell you
FIRST states plainly that EPSS is not a complete risk score. It does not measure how much damage successful exploitation would cause, and it gives no context for specific instances.
| Question | Does EPSS answer it? |
|---|---|
| Is this flaw likely to be attacked somewhere soon? | Yes, as an estimate |
| Are we running the affected component? | No |
| Is it exposed to attackers in our setup? | No |
| How bad would it be for us? | No |
| Has it already been exploited? | Not directly. Use an exploited-vulnerability list for that |
How a manager can use it
Treat EPSS as one of three signals, with the others being whether you run the component and whether it is exposed. A common pattern for ordering work:
- Confirm you run it.
- Check exposure and reachability.
- Use exploitation evidence and EPSS to order the confirmed items.
Do not set a single cutoff and call it policy without recording why. Different organisations pick different thresholds, and the right one depends on how many findings you can handle.
Common misreadings
- "Low EPSS means safe." A low score means exploitation is estimated as unlikely in the window, not impossible. A low score on an exposed, high-impact system can still deserve a fix.
- "EPSS replaces CVSS." They answer different questions. CVSS describes severity of the flaw in the abstract. EPSS estimates likelihood of exploitation.
- "The score is fixed." It is recalculated, so it changes. Record the date with any score you quote.
What to say in a meeting
"EPSS says there is a 4 percent chance this gets exploited in the next month. We run the component on an internet-facing service, so we are fixing it this week anyway."
That sentence uses the number honestly and ties it to your own situation.
Try it yourself
Click through it at your own pace, or open it full screen. Click through to see how a finding is checked against exploitation signals and local context. Notice that the score is only one input.
Where Safeguard fits
Safeguard's dependency scanning and reachability analysis supply the local facts EPSS leaves out. The free scan is at gold.safeguard.sh/scan.
Quick check
Is an EPSS score of 0.5 a 50 percent chance of being hacked?
No. It is an estimated chance the flaw is exploited somewhere in the wild within 30 days, not a chance that your company is attacked.
Should we ignore low EPSS findings?
No. Schedule them by exposure and impact rather than dropping them.
Sources
Last reviewed: 19 October 2026.
