What Is an EPSS Score, and What Does It Miss?

Key Takeaways

• An EPSS score estimates the probability that a specific CVE will be exploited somewhere in the world within the next 30 days. It is not a measure of risk to you.
• The score and the percentile are two different numbers. A CVE in the 90th percentile can still have a single-digit probability.
• FIRST publishes no official threshold, because picking one is a statement about your budget and your risk tolerance.
• The model changed on June 15, 2026. Score history that crosses that date is not an apples-to-apples trend.
• EPSS ranks the world. Your asset context and proof of what is actually reachable in your estate turn the ranking into a decision.

TL;DR

EPSS is a free machine learning model that publishes a daily probability (0 to 1) that a published CVE will see exploitation activity in the next 30 days. It is strong at the one job it was built for and silent on everything else, including whether you even run the affected software.

Teams get burned in three predictable ways: reading the percentile as probability, treating a low score as proof of safety, and comparing scores across a model version change. Read the number narrowly, and it saves you weeks of patching. Read it as a risk score, and it will point you at the wrong queue.

Patching by Severity Costs 20 Times More Work

FIRST measured both strategies against the same 139,473 scored CVEs in October 2023. Patching everything at CVSS 7 and above meant working 57.4% of the backlog to catch 82.2% of the CVEs that were actually exploited. Only 4% of that work landed on a CVE anyone touched. Setting the cutoff at an EPSS score of 0.1 instead meant working 2.7% of the backlog, catching 63.2%, with 65.2% of the effort on target.

What an EPSS Score Actually Measures

EPSS answers one narrow question. Over the next 30 days, how likely is it that someone, somewhere, tries to exploit this specific CVE?

The output is a number between 0 and 1. A score of 0.42 means the model puts the odds at 42% for that window.

FIRST’s own guidance is blunt about the limits here. EPSS estimates exploitation likelihood, and that is one input to a risk decision rather than the decision itself.

The 30 Day Window Is the Part People Skip

The score is not a permanent property of the CVE. It describes the next month and recalculates daily.

A CVE that sat at 0.03 for a year can jump past 0.5 in a week once working exploit code circulates. A quarterly review will never see that move.

Exploitation Activity Means Attempts, Not Compromise

The training signal comes from honeypots, intrusion detection sensors, and host-based detection feeding in from FIRST’s data partners. That evidence shows someone tried. It does not show anyone succeeded.

This matters when you quote a score to an executive. A high EPSS score means attackers are probing, not that breaches are happening.

Probability and Percentile Are Two Different Numbers

FIRST publishes both for every CVE, and teams mix them up constantly. The daily file carries three fields: the CVE, the EPSS score, and the percentile.

The score is the estimate. The percentile is the proportion of all scored CVEs that sit at the same score or lower.

Why a High Percentile Can Still Be a Low Probability

Exploitation is rare, so the scores pile up near zero. That skew pulls the percentile ranking up fast while the actual probability stays small.

A CVE at the 90th percentile outranks 90% of everything scored that day and might still carry a 9% chance of exploitation. The steep part of the curve lives in the last few percentile points.

Pick one number for your policy and stay with it. A threshold on percentile and a threshold on probability will not select the same CVEs.

What EPSS Does Not Know About You

The model has never seen your network. Four things it cannot account for:

• Whether you run the affected software at all.
• Whether the asset faces the internet or sits behind three layers of access control.
• What the asset does, and what breaks if someone owns it.
• Which compensating controls already block the path.

A 0.03 score on your public payment gateway deserves more attention than a 0.60 on a lab box nobody can reach. EPSS cannot make that call, and it was never built to.

How the Model Is Built

The EPSS Special Interest Group at FIRST maintains EPSS, generates scores using Empirical Security, and publishes them for free.

It trains on 12 months of historical data, then refreshes daily across every published CVE. Exploitation data comes in from industry and government partners including VulnCheck, the Shadowserver Foundation, and LevelBlue.

Why KEV Feeds the Model as Input, Not Outcome

Here is a detail that explains a lot of confusing score behavior. EPSS treats the CISA KEV catalog and Google Project Zero listings as vulnerability information, not as exploitation activity.

The reason is timing. A KEV listing records something that already happened, and EPSS is always looking at the next 30 days. So the model learns what tends to follow a KEV listing rather than reacting to the listing itself.

That is why a CVE can land on KEV without its EPSS score spiking. The two signals aren’t redundant, which is why mature programs run both.

Effort, Coverage, and Efficiency

These three numbers are how you defend a threshold choice to a board, so they are worth learning properly.

Effort is the share of your backlog a strategy tells you to work. Research from Cyentia and Kenna Security, cited in FIRST’s own documentation, found that most organizations clear 10% to 15% of open vulnerabilities per month, which is the ceiling any threshold must respect.

Coverage is the share of actually exploited CVEs that your strategy caught.

Efficiency is the share of your work that landed on a CVE someone tried to use.

The three move against each other. Push coverage up and effort rises while efficiency falls. The only way to break that trade is a better prioritization signal, which EPSS provides in a single sentence.

Why FIRST Publishes No Official Threshold

There is no blessed “critical” cutoff for EPSS, and that is deliberate. A threshold reflects how much risk you are willing to carry and how many hours you have.

A team with two analysts should favor efficiency and accept lower coverage. A bank with a full program can buy coverage by putting in more effort. Both are correct. The 0.1 cutoff you see quoted everywhere, including in this article, is an example FIRST uses for math, not a recommendation.

The Model Changed in 2026

EPSS version 5 started publishing on June 15, 2026, replacing version 4, which had run since March 17, 2025.

Empirical Security, which builds the model, reports that v5 scores 318,000 or more published CVEs and measured roughly a 23% improvement in surfacing the vulnerabilities that matter against a May 2026 test set. That figure comes from the model’s maintainers rather than independent review, so treat it as their measurement.

What Changes for Your Historical Data

Each model version shifts scores on its start date. If your dashboard plots EPSS trends across June 15, 2026, part of the movement you see is the model changing, not the threat landscape.

Two practical fixes. Mark the version boundary on any chart that crosses it, and recheck any threshold you tuned under v4 against how your backlog sorts under v5.

Where Secure.com Fits

EPSS tells you what the world is likely to attack. It cannot tell you what an attacker could actually reach inside your estate, and that gap is where remediation hours get wasted.

Secure.com closes it by pairing the global signal with proof from your own environment.

• The Red Teammate attacks your approved scope and confirms which scored CVEs are genuinely reachable, instead of leaving you to guess based on probability.
• The Infrastructure Security Teammate layers EPSS, CVSS, KEV status, and asset exposure against your live posture, then re-ranks the queue daily as scores move.
• Remediation runs within the scope, permissions, and approval gates your team defines, pausing consequential actions for human approval.
• Every decision is logged, so you can show an auditor why you patched one CVE in 24 hours and accepted another.
• Retesting after the fix produces before-and-after evidence, closing the loop rather than reopening the backlog.

FAQs

The Bottom Line

EPSS is the cheapest prioritization signal available, and it does one job well. It narrows a backlog of thousands down to the few hundred that attackers are plausibly working on right now.

What it hands you is a shorter list, not a decision. The decision needs your asset context, your exposure, and proof of what is really reachable. Get the reading right, and EPSS gives back most of the hours your team spends patching things nobody was ever going to touch.