EPSS & KEV
From theoretical severity to practical exploitation: how to prioritise vulnerabilities with evidence
What Is EPSS?
EPSS stands for Exploit Prediction Scoring System. It is produced by FIRST through the EPSS Special Interest Group and is documented at FIRST EPSS. EPSS estimates the probability that a specific vulnerability will be exploited in the wild within the next 30 days. Unlike severity frameworks, EPSS focuses on likelihood of near-term attacker activity.
This makes EPSS a prioritisation signal rather than a replacement for technical scoring. Security teams use it to identify which CVEs are most likely to become operational incidents soon, especially when remediation capacity is constrained. The model methodology and feature details are published at FIRST EPSS model.
How EPSS Works
EPSS uses a machine learning model trained on vulnerability and exploitation telemetry to estimate exploitation probability over a 30-day horizon. Inputs include CVE characteristics and external signals associated with attacker behavior, exploit publication, and vulnerability attention patterns. The model is statistical, so outputs represent probability estimates, not deterministic outcomes.
Operationally, EPSS should be interpreted as a dynamic forecast that changes as ecosystem conditions change. A CVE with low probability today can move higher as exploit tooling or targeting patterns evolve. This is why EPSS is updated daily, enabling teams to continuously re-rank remediation priorities instead of relying on static snapshots.
Understanding EPSS Score and Percentile
EPSS score ranges from 0.0 to 1.0 and represents estimated probability of exploitation in the next 30 days. Higher values indicate higher modeled likelihood. EPSS data is often paired with percentile ranking, which indicates how a CVE compares to others in the current dataset. A high percentile can be useful even when absolute probabilities appear numerically small.
In practice, teams define policy thresholds using both fields. For example, they may escalate vulnerabilities above a chosen probability cutoff or above a percentile band aligned to remediation capacity. Interpreting score and percentile together avoids overreacting to raw decimals while still surfacing relative outliers in large vulnerability inventories.
EPSS vs CVSS: Likelihood and Severity
CVSS and EPSS answer different questions. CVSS estimates technical severity under defined conditions, while EPSS estimates probability of exploitation in the near term. A vulnerability can have high CVSS severity and low EPSS probability, or moderate CVSS severity and high EPSS probability. Conflating these dimensions leads to inefficient prioritisation.
The strongest approach is to combine both signals: CVSS for impact potential and EPSS for likely attacker action. If you need a CVSS refresher, see CVSS Scoring. This combination improves triage quality by reducing noise from severe-but-unlikely issues while elevating exploitable paths with realistic threat momentum.
EPSS Sources and Update Cadence
EPSS is published as an open dataset and refreshed daily by FIRST. Daily updates are important because exploitation ecosystems are dynamic: exploit code availability, attacker targeting, and vulnerability visibility all change over time. Regular refresh allows defenders to re-prioritise continuously rather than locking decisions to stale scoring runs.
Program teams commonly ingest EPSS into vulnerability platforms and ticketing workflows so prioritisation updates automatically as new values arrive. This supports evidence-based patch planning and helps align remediation with current threat behavior rather than static severity inventories.
What Is CISA KEV?
KEV is CISA’s Known Exploited Vulnerabilities Catalog, available at CISA KEV catalog. It lists vulnerabilities for which there is credible evidence of active exploitation in the wild. In prioritisation terms, KEV is a high-confidence exploitation signal: not theoretical, not hypothetical, but observed attacker use.
For US federal civilian agencies, KEV is operationally tied to BOD 22-01, which mandates remediation timelines for cataloged vulnerabilities. Even outside federal scope, many organisations treat KEV inclusion as a critical escalation condition because it indicates demonstrated adversary value.
KEV as a Binary Decision Factor
KEV behaves differently from probabilistic models. It is effectively binary in triage logic: a vulnerability is either listed as known exploited or it is not. That does not measure global prevalence or your specific exposure level, but it does provide a strong signal that active exploitation exists and can affect similarly exposed environments.
Many programs therefore treat KEV inclusion as a default “patch now” trigger, adjusted only by immediate feasibility constraints such as outage risk or emergency change controls. Combining KEV status with asset exposure and compensating controls produces practical, defensible urgency decisions.
Using EPSS + KEV + CVSS Together
A practical prioritisation matrix combines all three signals. KEV listed: treat as immediate remediation candidate. High EPSS + high CVSS: urgent remediation, especially for internet-facing or business-critical assets. High CVSS + low EPSS: schedule within policy SLA with contextual review. Low CVSS + high EPSS: evaluate exposure quickly, as exploitation likelihood may outweigh moderate technical severity.
This blended approach addresses a core limitation of CVSS-only workflows: technical severity alone does not predict attacker behavior. For broader context, connect this model to Vulnerability Management, Threat Intelligence, and Risk Assessment. If you want EPSS/KEV-informed exploration in practice, use patch8.link42.app.
Continue Learning
- CVSS Scoring — Understand technical severity metrics that complement EPSS probability and KEV status.
- Vulnerability Management — Build a full intake-to-remediation process that uses multiple prioritisation signals.
- Threat Intelligence — Connect vulnerability prioritisation to adversary behavior and campaign context.
- Risk Assessment — Translate vulnerability evidence into business impact and treatment decisions.
- patch8.link42.app — Explore vulnerability intelligence enriched with EPSS and KEV context.