EPSS (Exploit Prediction Scoring System).

EPSS combines machine learning with real-world signals — published exploits, threat-intelligence telemetry, vendor advisories, social-media chatter — to produce two numbers per CVE: a probability (0–1) and a percentile rank. It complements CVSS by answering not how bad a flaw could be in theory, but how likely it is to actually be exploited soon. Vulnerability-management programmes use EPSS to triage huge backlogs: a critical CVSS issue with a very low EPSS may wait, while a medium CVSS issue with a high EPSS and KEV listing often jumps the queue. Scores are refreshed daily.

The model is governed by the FIRST EPSS Special Interest Group and has been retrained repeatedly: v1 (2019) used a logistic regression on a handful of features; v2 (February 2022) and v3 (March 2023) moved to a gradient-boosted model (XGBoost) with over a thousand features; and v4, released 17 March 2025, added malware and endpoint-detection telemetry and now tracks exploitation for more than 10,000 CVEs each month. FIRST publishes daily scores as a free CSV download and JSON API. A key design point is that EPSS is a forecast of near-term activity, not a measure of impact — so it is best paired with asset context, CVSS, and CISA's KEV catalog rather than used alone. Because scores drift as new intelligence arrives, a CVE sitting at EPSS 0.02 today can spike past 0.9 within days of a public proof-of-concept, which is why teams re-pull the feed daily rather than snapshotting it.

flowchart LR
  A[New CVE published] --> B[EPSS daily model run]
  C[Exploit DB / PoC code] --> B
  D[IDS / honeypot telemetry] --> B
  E[Malware & EDR signals] --> B
  B --> F[Probability 0-1]
  B --> G[Percentile rank]
  F --> H{High EPSS and KEV listed?}
  G --> H
  H -- Yes --> I[Patch now / jump the queue]
  H -- No --> J[Defer, re-check daily]