EPSS: Exploit Prediction Scoring System Guide

The Exploit Prediction Scoring System (EPSS) is an open, data-driven standard estimating the probability that a software vulnerability will be exploited in the wild within 30 days. Maintained under the Forum of Incident Response and Security Teams (FIRST), EPSS provides security teams and research institutions with empirical threat forecasting to prioritize vulnerability remediation beyond static severity ratings alone.

What is the EPSS system?

The Exploit Prediction Scoring System answers a practical operational question: among thousands of disclosed software vulnerabilities, which ones are threat actors actively weaponizing right now? Traditional vulnerability management relies on severity metrics describing theoretical damage if an exploit succeeds. EPSS shifts focus toward probability, predicting whether exploitation activity will be observed in the wild within 30 days.

For each published Common Vulnerabilities and Exposures (CVE) record, EPSS outputs two complementary figures:

EPSS Probability: A decimal score from 0.0 to 1.0 (0% to 100%) representing the estimated likelihood that exploitation activity will be detected in the wild over the next 30 days.
EPSS Percentile: A relative ranking from 0.0 to 1.0 (0% to 100%) measuring where a vulnerability’s probability sits compared to all other scored CVEs.

Who runs it and what it covers

EPSS is governed by the FIRST EPSS Special Interest Group (SIG), an international working group of cybersecurity researchers, data scientists, and vulnerability analysts. Daily model operations and score generation are provided by Empirical Security, which publishes updated scores seven days a week.

EPSS covers the catalog of publicly disclosed CVEs in the National Vulnerability Database (NVD) and MITRE CVE list. To generate predictions, the underlying machine learning pipeline uses gradient-boosted decision trees (XGBoost) trained on approximately 2,850 features. These include vulnerability metadata, weaponization indicators (such as public exploit code and Metasploit modules), and real-time threat telemetry from external security partner honeypots and sensors.

How to search or use it

EPSS provides open access through a public REST API and daily bulk downloads. Security teams can integrate EPSS data using the following steps:

Select an integration method: Use the live REST API for single-ticket lookups. For enterprise vulnerability scanners and bulk database enrichment, download the daily compressed CSV file.
Query the live API for a single CVE: Send an HTTP GET request to the FIRST API endpoint: https://api.first.org/data/v1/epss?cve=CVE-2021-44228. The API returns a JSON response containing the CVE ID, EPSS probability score, percentile ranking, and calculation date.
Query batch CVE records: Retrieve up to 100 CVE scores in a single request by passing comma-separated identifiers: https://api.first.org/data/v1/epss?cve=CVE-2023-38606,CVE-2023-32434.
Retrieve historical scores: Audit past vulnerability decisions by adding date=YYYY-MM-DD to evaluate predicted probability on a specific date in history.
Download daily bulk score archives: Retrieve the full population score file published daily at https://epss.empiricalsecurity.com/epss_scores-current.csv.gz containing cve, epss, and percentile.
Inspect probability alongside percentile: Examine the probability value to evaluate absolute risk, and use the percentile ranking to establish programmatic filtering baselines.
Incorporate local asset reachability: Combine EPSS probabilities with institutional network architecture controls, verifying whether vulnerable services are exposed or protected behind isolated subnets.

What is the difference between CVSS and EPSS?

A frequent point of confusion in vulnerability management is conflating the Common Vulnerability Scoring System (CVSS) with EPSS. While both produce numerical outputs for CVEs, they measure fundamentally different dimensions:

CVSS measures intrinsic severity: The CVSS Base score reflects the theoretical impact and technical complexity of a vulnerability under ideal conditions. It is a static metric that remains unchanged unless the definition is revised. As documented by FIRST, CVSS Base scores represent severity, not operational risk.
EPSS measures dynamic exploit probability: EPSS predicts the real-world likelihood that threat actors will exploit a vulnerability in the wild within 30 days. It updates daily to capture shifts in attacker activity and weaponization.

Remediation strategies that filter solely on high CVSS scores (such as CVSS ≥ 7.0) often overwhelm security teams, because roughly 50% of published vulnerabilities receive high or critical CVSS ratings, yet only a tiny fraction are ever weaponized. Pairing EPSS with CVSS allows organizations to focus remediation on vulnerabilities that are both high impact and actively likely to be exploited.

What is the normal range for EPSS?

The normal numerical range for EPSS probability is between 0.00000 and 1.00000 (0% to 100%). However, score distribution across the global vulnerability population is intensely skewed toward zero.

Empirical security research indicates that across all published CVEs, only approximately 2.5% to 3.0% experience observable in-the-wild exploitation activity in any given 30-day window. Because EPSS is calibrated to reflect actual threat base rates, the vast majority of vulnerabilities receive very low probability scores:

Scores between 0.001 and 0.05 (0.1% to 5%): Represent the vast majority of disclosed CVEs where no active threat campaigns have been observed.
Scores above 0.10 (10%): Represent an elevated threat level. Because non-exploited vulnerabilities dominate the catalog, an EPSS probability of 0.10 typically places a vulnerability at or above the 95th percentile of all scored CVEs.
Scores above 0.50 (50%): Represent acute exploitation targets, frequently corresponding to widely targeted remote code execution flaws.

Practitioners should avoid assuming an EPSS score of 0.10 is negligible; in a relative ranking, a 10% probability indicates a CVE that is far more dangerous than 95% of all disclosed flaws.

Strengths and limits

EPSS delivers measurable efficiencies for vulnerability management, but practitioners must understand its operational scope:

Strengths:
- Empirical grounding: Predictions are calibrated against real-world threat telemetry.
- Daily updates: Scores reflect immediate weaponization shifts and new public exploits.
- Free and accessible: Requires no proprietary license, commercial scanner subscription, or API key.
Limits:
- Population-level modeling: EPSS predicts global exploitation probability; it cannot determine whether a vulnerable package is exposed to an untrusted network inside your specific enterprise.
- Targeted attacks: Highly targeted zero-day exploits or narrow espionage campaigns may not generate sufficient telemetry on public honeypots to raise global EPSS probabilities.
- Dependency on CVE identifiers: EPSS cannot score internal proprietary flaws lacking an official CVE record.

In enterprise governance frameworks such as NIST Cybersecurity Framework 2.0, ISO 27001, and institutional CMMC compliance programs, EPSS serves as an empirical prioritization signal alongside foundational controls outlined in cybersecurity practice standards.

Alternatives and complementary frameworks

EPSS is most effective when integrated alongside complementary vulnerability management frameworks. The table below compares the primary open standards used across modern threat management programs:

Framework	Primary Metric	Update Frequency	Governance Body	Primary Role in Triage
EPSS	30-day exploit probability (0.0–1.0) and percentile	Daily	FIRST EPSS SIG	Predictive prioritization of weaponization likelihood
CVSS	Technical severity score (0.0–10.0) based on vector metrics	Static (per disclosure)	FIRST CVSS SIG	Assessing intrinsic severity and potential damage
CISA KEV	Binary catalog listing (confirmed active exploitation in the wild)	Dynamic (as confirmed)	Cybersecurity and Infrastructure Security Agency	Mandatory remediation deadlines for known exploited flaws
SSVC	Decision tree recommendations (Track, Attend, Act)	Contextual evaluation	CISA and Carnegie Mellon SEI	Stakeholder-specific remediation decision trees

Frequently Asked Questions

What is a level 2 EPSS?

In cybersecurity vulnerability management, EPSS does not define official numerical tiers or “levels” such as Level 1, Level 2, or Level 3. Unlike maturity models or tiered compliance frameworks, EPSS produces a continuous probability from 0.0 to 1.0 and a relative percentile. When security teams refer to a “level 2 EPSS,” they are typically describing an internal organizational triage tier (such as medium-priority remediation) or confusing the query with medical diagnostics: in echocardiography, EPSS refers to E-point septal separation, an ultrasound metric that evaluates cardiac ventricular function rather than computer security.

How often are EPSS scores generated?

EPSS scores are generated and published daily, typically shortly after 13:30 UTC. Each daily release scores all active CVEs in the public catalog and updates both the live REST API and the daily downloadable CSV archive.

Does using EPSS require an API key or paid subscription?

No. EPSS is an open community initiative hosted by FIRST. Both the public REST API and the daily compressed CSV files are freely accessible to the public without registration, authentication tokens, or licensing fees.

Sources

FIRST EPSS Special Interest Group Overview: https://www.first.org/epss/ (November 8, 2026)
FIRST EPSS Frequently Asked Questions: https://www.first.org/epss/faq (November 8, 2026)
FIRST EPSS How It Works and Architecture: https://www.first.org/epss/how-it-works (November 8, 2026)
FIRST EPSS Using EPSS in Practice: https://www.first.org/epss/using-epss (November 8, 2026)
FIRST EPSS Data Access and API Reference: https://www.first.org/epss/data (November 8, 2026)