What is EPSS? The Exploit Prediction Scoring System explained

EPSS, the Exploit Prediction Scoring System, is a machine-learning model maintained by the FIRST EPSS Special Interest Group. It estimates the probability that a published CVE will be exploited in the wild within the next 30 days, expressed as a number from 0 to 1.

How to read the score

An EPSS score of 0.02 means the model puts the chance of exploitation in the next 30 days at about two percent. A score near 1 means the model considers it very likely.

EPSS also publishes a percentile alongside the probability. The percentile shows where a CVE sits relative to all others, which is handy because most scores are small and a raw 0.02 looks unimpressive until you see it is higher than most of the list.

FIRST states that scores are updated daily for every CVE. That matters: an old CVE can jump when exploit code appears.

EPSS versus CVSS

They answer different questions.

• CVSS describes how severe a flaw could be if exploited.
• EPSS estimates how likely exploitation is soon.

A flaw can be severe and unlikely to be attacked, or moderate and heavily targeted. Using both gives you a two-dimensional view instead of one flat ranking. See what CVSS is.

Where it fits in triage

A simple way to use it:

1. Start with confirmed exploitation, such as the KEV catalog. That is evidence, not prediction.
2. For the rest, sort by EPSS to find the ones most likely to move next.
3. Check reachability so you spend effort on code that runs.

Limits to keep in mind

• It is a probability, not a guarantee. A low score does not mean safe.
• It scores CVEs, so it says nothing about flaws with no CVE yet.
• It is global. It does not know whether the affected component is exposed in your environment.

Safeguard surfaces exploitation signals next to reachability so you can combine them yourself. Try a free scan at gold.safeguard.sh/scan.

Quick check

Sources

• FIRST: Exploit Prediction Scoring System

Last reviewed: 19 October 2026.