# Exploit Prediction Scoring System (EPSS)
The Exploit Prediction Scoring System (EPSS) is a data-driven model maintained by FIRST (Forum of Incident Response and Security Teams) that estimates the probability of a vulnerability being exploited in the wild within 30 days. Unlike CVSS, which measures technical severity, EPSS focuses exclusively on exploitation likelihood using machine learning trained on historical exploitation data, vulnerability characteristics, and real-world threat intelligence feeds.
EPSS exists because severity alone is a poor predictor of exploitation. A critical CVSS score indicates that a vulnerability could cause significant damage if exploited, but provides no information about whether exploitation will actually occur. This distinction matters because most organizations cannot remediate all vulnerabilities simultaneously. Security teams need to know not just what could be exploited, but what is likely to be exploited first.
The system addresses the fundamental gap between vulnerability discovery and vulnerability prioritization. Traditional approaches rank vulnerabilities by CVSS score, age, or asset criticality. These methods assume that attackers behave rationally according to technical severity metrics. In practice, attackers choose targets based on factors like exploit availability, target abundance, defensive awareness, and campaign objectives that have little correlation with CVSS ratings.
EPSS transforms vulnerability management from a reactive process driven by scanner output into a predictive process informed by adversary behavior patterns. Rather than asking "how bad would this be if exploited," security teams can ask "how likely is this to be exploited" and allocate remediation resources accordingly. This shift from severity-based to probability-based prioritization represents one of the most significant advances in vulnerability management methodology since the introduction of standardized scoring systems.
EPSS operates through a sophisticated machine learning pipeline that ingests multiple data sources, processes them through feature engineering, and outputs probability scores updated daily. The system's predictive power comes from combining structured vulnerability metadata with unstructured threat intelligence signals that indicate real-world exploitation patterns.
The primary data sources include CVE metadata from the National Vulnerability Database, which provides technical details about vulnerability types, affected products, attack vectors, and CVSS scores. Exploitation evidence comes from security vendors who contribute anonymized telemetry about observed attacks, intrusion detection alerts, and incident response findings. Social media monitoring captures discussion of new exploits on Twitter, Reddit, and specialized security forums. Proof-of-concept availability tracking monitors GitHub, exploit databases, and security research publications for working exploit code. Dark web intelligence feeds provide early warning when new exploits enter underground markets.
The machine learning model uses logistic regression to process these inputs into probability predictions. Logistic regression was chosen over more complex algorithms because it provides interpretable results and avoids overfitting on the relatively sparse dataset of confirmed exploitations. The model trains on historical data where the outcome (exploitation within 30 days) is known, learning which combinations of features correlate with actual adversary activity.
Feature engineering transforms raw inputs into predictive signals. For example, the presence of public exploit code is not binary but weighted by factors like code quality, ease of use, and publication venue. A fully automated exploit published by a reputable security researcher carries more predictive weight than proof-of-concept code requiring significant modification. Similarly, social media chatter is analyzed for context, distinguishing between academic discussion and operational planning.
The model outputs two metrics for each CVE. The EPSS score is a probability between 0 and 1, where 0.7 indicates a 70% chance of exploitation within 30 days. The percentile ranking compares each CVE against all scored vulnerabilities, providing relative context. A vulnerability in the 95th percentile faces higher exploitation probability than 95% of all other vulnerabilities, regardless of its absolute EPSS score.
Daily updates ensure the system responds to changing threat conditions. When a new exploit appears, EPSS scores for affected vulnerabilities increase rapidly. When attention shifts to different vulnerability types or attack vectors, scores adjust accordingly. This dynamic updating distinguishes EPSS from static scoring systems that remain constant until vulnerability details change.
The scoring methodology accounts for temporal factors that influence exploitation patterns. Newly disclosed vulnerabilities often experience a surge in exploitation attempts as attackers race to compromise unpatched systems. Older vulnerabilities may see renewed activity when new exploit techniques emerge or when specific campaigns target previously ignored flaws. EPSS captures these patterns by incorporating time-based features alongside technical characteristics.
Validation occurs through continuous backtesting against known exploitation events. FIRST maintains a ground truth dataset of confirmed exploitations derived from vendor reports, incident response findings, and honeypot data. The model's performance is measured by its ability to predict these events correctly, with regular recalibration to maintain accuracy as attack patterns evolve.
EPSS transforms vulnerability management economics by dramatically improving remediation efficiency. Research conducted by FIRST demonstrates that organizations prioritizing by EPSS scores capture significantly more exploited vulnerabilities while remediating far fewer total CVEs compared to CVSS-only approaches. For resource-constrained security teams, this efficiency gain means the difference between reactive patching and proactive risk reduction.
The traditional approach of prioritizing by CVSS score forces teams to remediate thousands of high-severity vulnerabilities, most of which will never be exploited. This creates several problems. First, engineering teams become overwhelmed by unrealistic remediation demands, leading to delayed patching cycles and incomplete fixes. Second, security teams lose credibility when they consistently flag vulnerabilities as urgent that never see actual exploitation. Third, organizations spend excessive resources on low-probability risks while potentially overlooking vulnerabilities that attackers actually target.
EPSS addresses these problems by focusing attention on vulnerabilities with the highest probability of real-world exploitation. A vulnerability with an EPSS score of 0.8 and a CVSS score of 6.5 may warrant immediate attention, while a vulnerability with an EPSS score of 0.1 and a CVSS score of 9.2 can be scheduled for routine patching. This approach aligns security priorities with adversary behavior rather than theoretical impact scenarios.
The business impact extends beyond improved patch prioritization. EPSS enables more accurate risk calculations for business leadership, replacing vague severity assessments with quantified probability estimates. When explaining why certain vulnerabilities require emergency patching, security teams can cite specific likelihood percentages rather than subjective severity ratings. This precision improves communication between technical teams and business stakeholders who need to understand resource allocation decisions.
A common misconception is that EPSS replaces CVSS entirely. Both scoring systems serve different purposes and provide complementary information. CVSS indicates the potential impact if exploitation occurs, while EPSS indicates the likelihood that exploitation will occur. Optimal vulnerability management uses both metrics, prioritizing vulnerabilities that combine high exploitation probability with significant potential impact.
Another misconception is that EPSS predictions are deterministic. The system provides probability estimates based on historical patterns, not guarantees about future events. A vulnerability with a low EPSS score can still be exploited, particularly if attackers change tactics or if new information becomes available. EPSS should inform prioritization decisions, not replace security fundamentals like timely patching and defense in depth.
CDA integrates EPSS scoring into every Vulnerability Surface Defense (VSD) domain engagement through the Continuous Surface Reduction (CSR) methodology. Every surface you expose is a surface we eliminate, and EPSS data helps identify which surfaces attackers are most likely to target first. This integration ensures that remediation efforts focus on reducing actual attack surface rather than theoretical vulnerability counts.
The VSD domain owns EPSS implementation within the PDM framework because exploitation prediction directly supports surface reduction objectives. Traditional vulnerability management approaches measure success by the number of vulnerabilities found or patched. CSR measures success by the reduction in exploitable attack surface, which requires understanding not just what vulnerabilities exist but which ones attackers will actually attempt to exploit.
CDA's approach differs from conventional vulnerability management consulting in several key ways. Most security firms treat EPSS as supplementary information, adding it to existing CVSS-based workflows without fundamentally changing prioritization logic. CDA positions EPSS as the primary prioritization mechanism, using CVSS scores to assess potential impact after EPSS scores identify high-probability targets. This reversal places adversary behavior at the center of vulnerability management strategy.
Theater mission deliverables rank findings by exploitation probability alongside severity, ensuring clients allocate remediation effort where adversaries are most likely to strike. Rather than providing clients with lengthy vulnerability lists sorted by CVSS score, CDA delivers prioritized remediation roadmaps that sequence fixes based on EPSS predictions. This approach transforms vulnerability reports from compliance documents into operational playbooks.
EPSS alignment is a standard quality metric in CDA's C2 rating system for vulnerability management missions. Engagements that fail to incorporate EPSS data into prioritization decisions cannot achieve the highest C2 ratings, regardless of other technical factors. This requirement reflects CDA's position that modern vulnerability management must account for adversary behavior patterns, not just technical vulnerability characteristics.
The integration extends beyond individual vulnerability assessments to strategic surface reduction planning. CDA uses EPSS trends to identify vulnerability types, attack vectors, and product categories that consistently attract adversary attention. Clients receive recommendations not just about specific CVEs to patch, but about systemic changes to reduce exposure to high-EPSS vulnerability patterns. This strategic application of EPSS data supports long-term attack surface reduction rather than tactical patch management.
• EPSS provides probability-based vulnerability prioritization that aligns security efforts with actual adversary behavior patterns, dramatically improving remediation efficiency compared to severity-only approaches.
• The system uses machine learning trained on historical exploitation data, threat intelligence, and social signals to predict which vulnerabilities will be exploited within 30 days, with daily updates reflecting changing threat conditions.
• EPSS complements rather than replaces CVSS, providing exploitation likelihood while CVSS indicates potential impact, enabling risk-based prioritization that considers both probability and consequence.
• Organizations implementing EPSS-based prioritization capture more exploited vulnerabilities while remediating fewer total CVEs, solving the resource allocation problem that paralyzes traditional vulnerability management programs.
• CDA positions EPSS as the primary prioritization mechanism within the Continuous Surface Reduction methodology, focusing remediation efforts on vulnerabilities that attackers are most likely to target rather than those with the highest theoretical severity.
• Continuous Surface Reduction (CSR): Every Surface Eliminated • Vulnerability Surface Defense (VSD) Domain • Common Vulnerability Scoring System (CVSS) Limitations • Threat Intelligence Integration for Vulnerability Management • Risk-Based Vulnerability Management Frameworks
• Forum of Incident Response and Security Teams (FIRST). "Exploit Prediction Scoring System (EPSS)." https://www.first.org/epss/
• National Institute of Standards and Technology. "NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning." 2022.
• MITRE Corporation. "Common Vulnerabilities and Exposures (CVE) Program." https://cve.mitre.org/
• Jacobs, Jay, et al. "Exploit Prediction Scoring System (EPSS)." Digital Threats: Research and Practice, Vol. 2, No. 3, 2021.
• FIRST Special Interest Group. "EPSS User Guide and Implementation Best Practices." 2023.