A normal EPSS score is very low. FIRST's guidance says the median is around 0.7 percent and the mean around 2.8 percent, because most vulnerabilities are never exploited in a given 30 day window. A score of 5 percent already ranks in the top tenth of published CVEs.
The numbers FIRST gives
FIRST's pages state several figures, all as of the time of writing.
| Measure | Value stated by FIRST |
|---|---|
| Share of CVEs with observed exploitation in a 30 day window | Roughly 1.5 to 3 percent |
| Mean EPSS score | Around 2.8 percent |
| Median EPSS score | Around 0.7 percent |
| Share of published CVEs on the CISA KEV list | Roughly 0.5 percent |
| Probability that sits at the 95th percentile | About 10 percent |
These move over time, so check the FIRST pages before you quote them in a report.
Why scores cluster near zero
EPSS is a calibrated probability. If a score of 0.05 is honest, then about 5 in 100 CVEs near that score should show exploitation in the next 30 days. Since the large majority of CVEs are not exploited, the large majority get low scores. FIRST says a near zero estimate is a prediction, not a data gap.
FIRST gives a thought experiment. Imagine a time machine and the exact 10,000 CVEs, out of 350,000 published, that would see exploitation in the next 30 days. Score them perfectly and 97 percent of CVEs would get zero. That is the reality the model is calibrated against.
Why 50 percent is a poor threshold
A common instinct is that over 50 percent should be the top half, like marks in school. FIRST calls this out as a misuse. The top half of CVEs by score is above roughly 0.7 percent. A line at 50 percent would deprioritize the overwhelming share of published CVEs, and it selects only a very small group at the top. FIRST says 90 to 100 percent picks out about the top 0.2 percent.
How to read a score in practice
- Look at the percentile beside the probability. It tells you where the CVE ranks against all scored CVEs.
- Compare the probability to the base rate, not to 100. A value of 0.05 is well above a base rate near 0.02 to 0.03.
- Remember that small does not mean safe. FIRST notes that at 5 percent, about 1 in 20 similar CVEs will see exploitation.
- Use the value as an input next to KEV, reachability and exposure. See how to choose an EPSS threshold for the trade off.
A quick calibration exercise
Export the EPSS values for the CVEs in your own estate. Sort them. Find your own median and the share above 5 percent. If your median is far above the public median, your estate carries more older, exploited or tooled up flaws than the average CVE. If it is near the public figure, nothing unusual stands out. Either way, you now have a local picture to put on a slide, with the FIRST figures cited beside it.
Safeguard's SBOM and dependency scanning produce that list of CVEs for your own estate, and reachability analysis helps show which ones matter. You can try a free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Sort the findings and consider where a line at 5 percent would fall across the list.
Quick check
Is an EPSS score of 3 percent low?
In absolute terms it looks low, but it sits close to the mean FIRST reports and above the median. Read the percentile and the other signals before you decide.
Why not set the cut off at 50 percent?
Because exploitation is rare. FIRST says a 50 percent line would deprioritize nearly all published CVEs and ignores the long tail where much real activity sits.
Sources
Last reviewed: 19 October 2026.
