An EPSS score changes overnight because its inputs changed, not because the model did. Each day EPSS recomputes the features for every CVE and runs the same trained model. Signals such as new exploit code, new detection rules or a spike in discussion can move a score. Exploitation seen today does not feed tomorrow's score.
How the daily run works
FIRST describes EPSS as fully automated. New scores are published each day, typically within a minute or two after 13:30 UTC. The model is not retrained daily. It is retrained when monitoring shows its performance has drifted from the calibrated baseline, and in practice that has happened about once a year.
The first line of the daily CSV is a comment that names the model version the scores came from. If you keep history, store that line, so a step change in your trend can be traced to a model update.
What can move a score
The FAQ lists the kinds of new information that matter: exploit code becoming public, signatures being published, chatter spiking across monitored sources, or a detailed analysis appearing. In some cases existing information is removed.
The model uses roughly 2,850 features per CVE per day, drawn from several source categories. They run from facts known at disclosure, such as the CVSS metrics and descriptive tags, to signals that only appear weeks later as the community reacts.
A move from 0.02 to 0.15 overnight tells you something arrived. It is worth looking at why.
What does not move it
Here is the counterintuitive part. Recent exploitation activity does not directly change tomorrow's score. Exploitation data trains the model. It is not used in the daily scoring. FIRST gives two reasons. If it were, EPSS would leak exploitation activity it has no license to publish, and the score would not claim to see all activity.
Consequences for your process:
- Do not wait for EPSS to react to an incident. If a vendor or CISA says a flaw is being exploited, act on that. FIRST says confirmed and recent exploitation should take precedence over the score.
- A low score on a KEV-listed CVE is not a bug. KEV is a record of what happened. EPSS is a forecast for the next 30 days.
- EPSS has no view of your environment. It cannot tell that you run the affected product.
Using daily change well
Rather than alerting on every move, set rules that match your capacity. Two that work for small teams:
- Re-sort your open findings by EPSS each morning, and look only at the findings whose score or percentile rose past your cut line since yesterday.
- For any CVE that crosses the line, check KEV, check whether the vulnerable code is reachable, and then decide.
The API supports a 30 day history for a single CVE, which is handy when you need to explain why a ticket was reprioritized. You can also request a past date to reconstruct what the score was when you made a decision.
Safeguard's continuous monitoring watches your inventory as new data lands, so a changed signal does not wait for the next manual review. See the continuous monitoring demo.
Quick check
Does a new exploitation report raise tomorrow's EPSS score?
Not directly. Exploitation data trains the model but does not feed daily scoring. New threat signals such as exploit code or chatter can move the score.
How do I know if the model itself changed?
Read the comment on the first line of the daily CSV, which names the model version.
Sources
Last reviewed: 19 October 2026.
