What is EPSS?

The Exploit Prediction Scoring System (EPSS) estimates the probability that a published CVE will be exploited in the wild within the next 30 days. Its daily value ranges from 0 to 1, or 0 to 100 percent. EPSS complements the technical severity represented by CVSS but answers a different question.

Reading score and percentile

A score of 0.20 does not mean a particular company has a 20 percent chance of being attacked. It concerns the CVE and observable exploit activity, not an individual asset. A low score is not an all-clear: targeted, internal or poorly observed attacks may be absent from model data.

Example: retrieving EPSS through the API

GET https://api.first.org/data/v1/epss?cve=CVE-2021-44228

{
  "data": [{
    "cve": "CVE-2021-44228",
    "epss": "...",
    "percentile": "...",
    "date": "YYYY-MM-DD"
  }]
}

Automation should retain the date and refresh scores regularly. A value copied once into a ticket loses EPSS's adaptation to new exploits and evidence.

Combining EPSS, CVSS and KEV

• KEV and reachable asset:
  Exploitation is known; validate, mitigate or patch quickly and assess possible compromise.
• High EPSS:
  Exploitation is more likely; exposure and impact determine the deadline.
• High CVSS, low EPSS:
  Potentially severe but less frequently exploited at present; schedule based on context rather than ignore it.
• Low scores, critical asset:
  Business impact, attack chains and local intelligence can still justify high priority.

What are the limitations?

EPSS is neither a guarantee nor a complete risk score. It uses CVE information, exploit code and observed activity among its inputs. Observation is incomplete and new vulnerabilities have little history. Use EPSS to structure decisions, never to replace asset inventory, business impact or analyst review.