EPSS Exploit Prediction Scoring System
A probability score for whether a specific CVE will be exploited in the wild in the next 30 days. Better triage signal than CVSS alone; Vijilan Managed Exposure prioritizes by EPSS + asset criticality.
EPSS produces a probability between 0 and 1 that a given CVE will be exploited in the wild within the next 30 days. It is maintained by FIRST, the same body behind CVSS, and is rebuilt daily from observed exploitation activity and features of the vulnerability itself. A score of 0.9 means exploitation is very likely in that window; 0.001 means it is very unlikely.
It answers a different question from CVSS. CVSS scores how bad exploitation would be if it happened, in isolation from the world. EPSS estimates how likely exploitation is right now. Both matter, and using either alone distorts the queue: severity alone sends teams after critical vulnerabilities nobody is attacking, while likelihood alone can deprioritise a vulnerability that would be catastrophic on a crown-jewel system.
The reason this matters operationally is arithmetic. Only a small fraction of published CVEs are ever exploited in the wild, yet a severity-only policy treats every critical as equally urgent, which is how remediation backlogs become permanent. Combining likelihood with impact and with what the asset actually does is what turns a backlog into a queue that can be finished.
Common questions
What does EPSS stand for?
EPSS stands for the Exploit Prediction Scoring System. It is a data-driven model, maintained by FIRST, that estimates the probability a given vulnerability will be exploited in the wild in the next 30 days. Scores are republished daily as new exploitation activity is observed.
What is the difference between EPSS and CVSS?
CVSS measures severity: how much damage exploitation would do, scored in isolation and largely static once assigned. EPSS measures likelihood: the probability that exploitation actually occurs in the near term, recalculated daily. Severity tells you what it would cost you, likelihood tells you how soon to care, and neither substitutes for the other.
Should we patch by EPSS or by CVSS?
By both, plus asset context. A workable rule is to treat high likelihood combined with high severity as immediate, high severity on an internet-facing or business-critical asset as urgent regardless of likelihood, and low likelihood with low severity as routine maintenance. What matters is that the queue reflects exposure rather than a single number.
EPSS is one signal.
We watch the rest.
Vijilan runs a 24/7 SOC across endpoint, identity, cloud, network, SaaS and mobile, and acts on what it finds rather than forwarding an alert.