The Exploit Prediction Scoring System (EPSS) score is a data-driven estimate of the probability that a specific published vulnerability (CVE) will be exploited in the wild within the next 30 days. Developed and maintained by FIRST (the Forum of Incident Response and Security Teams), EPSS uses a machine learning model trained on real-world exploitation activity, vulnerability characteristics, and threat data. Each CVE receives a score between 0 and 1, often shown as a percentage, along with a percentile indicating how its likelihood compares to all other scored vulnerabilities. Scores are updated daily as new exploitation data emerges.
EPSS complements CVSS rather than replacing it. CVSS measures the technical severity of a vulnerability if exploited, while EPSS estimates how likely exploitation actually is. Because only a small fraction of published vulnerabilities are ever exploited, combining EPSS with CVSS, known-exploited vulnerability catalogs, and asset context helps teams focus vulnerability prioritization on issues that pose real near-term risk. EPSS does not account for an organization’s specific environment, such as asset criticality or compensating controls, so it should inform prioritization rather than determine it alone.