---
title: Exploit Prediction Scoring System (EPSS)
url: https://www.emergentmind.com/topics/exploit-prediction-scoring-system-epss
type: topic
---

# Exploit Prediction Scoring System (EPSS)

Searching arXiv for recent EPSS-related papers to ground the article.
arXiv search query: "Exploit Prediction Scoring System EPSS vulnerability prioritization"
The Exploit Prediction Scoring System (EPSS) is an open, data-driven scoring system that estimates, for each Common Vulnerabilities and Exposures (CVE) entry, the probability that the vulnerability will be exploited “in the wild.” In the original formulation, EPSS was defined as the probability of exploitation within the first twelve months after public disclosure; later work and the current operational framing describe it as a probability of exploitation within the next 30 days, expressed as a number in the interval $[0,1]$. EPSS is therefore a threat-likelihood model rather than a severity metric: it is designed to predict exploitation, not to measure technical impact, business criticality, or environmental exposure [1908.04856] [2302.14172] [2603.12450] [2411.02618].

## 1. Historical development and governance

EPSS emerged from the observation that vulnerability management programs were dominated by CVSS Base scores, ad hoc expert judgment, and incomplete data, even though CVSS does not measure threat and severity is not equivalent to risk. The 2019 EPSS paper presented what it described as the first open, data-driven framework for assessing vulnerability threat, with a published logistic-regression scoring function that used 16 features and was simple enough to implement in a spreadsheet [1908.04856].

Later work recast EPSS as a centralized, community-governed system. The 2023 EPSS Special Interest Group paper describes EPSS as a community effort involving more than 170 experts across industry, government, and academia, and identifies the third major version of the model as an XGBoost-based system trained on daily, multi-source telemetry and feature updates. That paper reports a precision-recall AUC increase from 0.4288 for EPSS v2 to 0.7795 for EPSS v3, which it summarizes as an 82\% performance improvement over past models in distinguishing vulnerabilities that are exploited in the wild [2302.14172].

This evolution also changed the operational horizon. The original EPSS work used exploitation within 12 months after disclosure as the prediction target, whereas later papers describe EPSS as a near-term predictor for the next 30 days. A plausible implication is that EPSS shifted from a disclosure-time threat estimate toward a continuously refreshed operational score aligned with monthly patching cycles [1908.04856] [2302.14172].

## 2. Statistical meaning and score semantics

Several papers formalize EPSS as a conditional probability model. One empirical comparison defines it as
\[
\text{EPSS}(v) = P(\text{“v will be exploited in the wild in a given time window”} \mid \text{features of vulnerability } v),
\]
with output on $[0,1]$ and a CVE-centric scope that is independent of any particular organization’s assets, business impact, or exposure [2508.13644].

The original EPSS implementation used Elastic Net regularized logistic regression. Its score was the logistic transform of a linear predictor built from vendor indicators, exploit-code indicators, vulnerability-characteristic tags, and a reference-count term:
\[
\Pr[\text{exploitation}_i] \equiv \text{EPSS}_i = \frac{1}{1 + e^{-\text{LogOdds}_i}}.
\]
The published model included 16 features, including `exp:weaponized`, `exp:poc_code`, `tag:code_execution`, `tag:remote`, and $\log(\text{ref\_count}+1)$ [1908.04856].

Later literature treats EPSS as a predictive exploitability model whose internal form may still include logistic-regression-style components,
\[
\text{EPSS}(v) = \sigma(\beta_0 + \beta_1 x_{v1} + \dots + \beta_k x_{vk}),
\]
but also notes that the current production model is more complex. In particular, the 2024 KEV-focused study characterizes EPSS v3 as an XGBoost model with 1477 features, while also observing that the exact feature list and transformations are not publicly available [2508.13644] [2411.02618].

Operationally, EPSS is distributed as a point-in-time score and is often accompanied by a percentile and timestamp. In the LLM-assisted threat-intelligence pipeline, each CVE record carries `epss`, `percentile`, and `date`, for example `epss = 0.61340`, `percentile = 0.97823`, and a dated model update. This supports both absolute-probability and rank-based interpretations [2504.00428].

## 3. Data sources, features, and model inputs

The original EPSS work assembled vulnerability metadata from MITRE CVE and NIST NVD, derived semantic tags from CVE references using Rapid Automatic Keyword Extraction, collected proof-of-concept exploits from Exploit-DB, collected weaponized exploit evidence from Rapid7 Metasploit, D2 Elliot Framework, and Canvas Exploitation Framework, and used exploitation telemetry from Proofpoint, Fortinet, AlienVault, and GreyNoise as the outcome variable. The study covered 25,159 CVEs published from June 1, 2016 through June 1, 2018, of which 921 were observed exploited in the wild within 12 months, for an exploitation rate of approximately 3.7\% [1908.04856].

The later EPSS v3 paper substantially expanded the feature universe. It reports 192,035 CVEs, 6.4 million exploitation observations over about 6.5 years, and 12,243 unique CVEs observed exploited. Its 1,477 variables are grouped into published exploit code, public vulnerability lists, social media, offensive security tools, reference counts and NVD reference tags, keyword descriptions, CVSS metrics, CWE indicators, vendor labels, and vulnerability age. The same paper states that exploitation labels were derived from Fortinet, AlienVault OTX, Shadowserver Foundation, and GreyNoise, aggregated as daily boolean observations of exploit attempts [2302.14172].

The transition from the 2019 model to later EPSS versions therefore involved both methodological and evidentiary broadening. In the original paper, EPSS could be implemented locally from public features; in the later architecture, scores are centrally recomputed and updated daily, reflecting newly observed exploit code, KEV additions, social-media mentions, and offensive-tool coverage [1908.04856] [2302.14172].

## 4. Empirical behavior and comparative evaluation

Across studies, EPSS is consistently distinguished from CVSS severity. The 2019 EPSS paper reports time-based validation results of ROC AUC $0.838$ and PR AUC $0.266$, versus substantial effort reductions relative to CVSS-threshold policies. For example, to match the coverage of a CVSS $\ge 7$ strategy, EPSS required 1,091 vulnerabilities of effort instead of 2,773, corresponding to an effort reduction of approximately 60.7\% [1908.04856].

The 2025 Microsoft Patch Tuesday comparison finds that EPSS is only weakly correlated with CVSS, has moderate-at-best correlation with SSVC and Microsoft’s Exploitability Index, and aligns better with real-world exploitation than severity alone. In that study, EPSS is evaluated on 600 vulnerabilities and is described as adding new information rather than merely re-ranking high-CVSS items [2508.13644].

A 2026 framework centered on Key Risk Indicators (KRI) provides a larger-scale quantitative assessment against the CISA Known Exploited Vulnerabilities catalog. It reports that EPSS alone achieves ROC-AUC $0.9299$ and AUPRC $0.3645$ on 280,694 CVEs, whereas the full KRI score achieves ROC-AUC $0.9307$ and AUPRC $0.2231$. The same paper interprets this as evidence that EPSS is the strongest pure exploit detector, while KRI serves a different objective by reordering vulnerabilities according to impact and exposure. At $k=500$, EPSS and KRI have identical KEV Recall@500 of $35.7\%$, but KRI achieves ERV@500 of $92.3\%$ compared with $82.6\%$ for EPSS and Critical Recall@500 of $68.5\%$ compared with $39.1\%$ for EPSS [2603.12450].

Not all evaluations are favorable. The 2024 study of high-severity KEV CVEs argues that EPSS v3 often behaves more as a trailing risk indicator than as a proactive predictor for newly disclosed, high-value perimeter and supply-chain vulnerabilities. It reports that, for all 250 KEV CVEs in its study period, more than two thirds had EPSS scores below $0.36$ immediately prior to KEV inclusion, and that among 57 KEV CVEs from 2023 or later, 42 had consistently low EPSS scores before KEV listing [2411.02618].

A further methodological critique comes from prospective evaluation. The 2026 evidence-graph paper shows that naive random splitting with unfiltered evidence inflates apparent prospective recall by $8.5\times$ and EPSS-high recall by $5.0\times$, arguing that exploitability prediction should be evaluated only with evidence available at a fixed decision time [2606.19076].

## 5. Operational use in prioritization systems

EPSS is often used as the threat-likelihood component of larger triage systems rather than as a standalone risk score. In the SBOM-driven IoT firmware triage pipeline, EPSS is the primary signal for “likelihood of exploitation” and is incorporated into a composite Risk Priority Score:
\[
\text{RPS} = (B \times W_b) + (E \times W_e) + (C \times W_c),
\]
with $B$ the CVSS Base Score, $E$ the exploitability factor, $C$ a context factor, and weights $W_b = 3.0$, $W_e = 4.0$, and $W_c = 3.0$. When a CVE is not in KEV, the paper defines $E = 10 \times p_{\text{EPSS}}$; when the CVE is in KEV, exploitability is overridden to $E = 10$. This makes EPSS the largest weighted component of the score unless KEV provides a hard override [2601.01308].

EPSS is also used as structured metadata in retrieval-augmented threat-intelligence systems. In the LLM-assisted proactive threat-intelligence architecture, EPSS is ingested through the Patrowl framework alongside CVE, CWE, and KEV feeds; stored in Milvus as metadata attached to CVE records; and exposed to GPT-4o through retrieved context. In that system EPSS is not a retrieval metric, but a probability-and-percentile field used for reasoning, filtering, and analyst-facing explanations [2504.00428].

In model-based IoT security quantification, EPSS is treated even more literally as an empirical exploit probability. The IoT attack-tree paper defines the probability of each Basic Attack Step as
\[
Pr(BAS_i)=EPSS(CVE_i),
\]
then propagates those probabilities through OR and AND gates,
\[
Pr_{OR}=1-\prod_{i=1}^{N}{\big( 1-Pr(BAS_i)\big)}, \qquad
Pr_{AND}=\prod_{i=1}^{N}{ Pr(BAS_i)},
\]
and maps the resulting attack tree to a Bayesian Network. In its smart irrigation case study, this yields a Top Event probability of $4.00 \times 10^{-2}$ [2606.16561].

These applications share a common pattern: EPSS is used as a numeric likelihood term that is easy to join on CVE identifiers, but it is rarely treated as sufficient on its own. Contextualization is supplied either by local deployment signals, KEV membership, or architecture-aware propagation logic [2601.01308] [2606.16561].

## 6. Limitations, criticisms, and related directions

A recurring limitation in the literature is that EPSS is not a risk score in the full organizational sense. It does not encode business impact, asset value, network exposure, or compensating controls; it is global and generic rather than environment-specific; and it may be less informative for newly disclosed vulnerabilities with limited telemetry. The Microsoft-only comparative study emphasizes that EPSS should complement CVSS and internal context rather than replace them [2508.13644].

Another criticism concerns opacity and exploit actionability. The AEAS paper describes EPSS as producing “opaque probability estimates” and argues that it does not assess whether usable exploit code exists, whether that code is functional, or how difficult it is to deploy. AEAS is therefore positioned as complementary to EPSS, focusing on exploit availability, functionality, setup complexity, and ranked exploit recommendations rather than on exploitation-in-the-wild probability [2509.17832].

Several adjacent proposals attempt to incorporate what EPSS omits. SecScore replaces the static CVSS Exploit Code Maturity factor with a time-dependent empirical function based on exploit-code emergence, while explicitly proposing use alongside EPSS [2405.08539]. Expected Exploitability (EE) predicts the development of functional exploits rather than exploitation in the wild, treats exploitability as time-varying, and reports increasing precision from 49\% to 86\% over existing metrics, including two state-of-the-art exploit classifiers [2102.07869].

Later work also raises methodological caution. The compute-budgeted evidence-graph framework argues that exploitability claims should be leakage-safe, prospective, and paired with evidence certificates listing supporting signals, timestamps, source layers, and leakage flags. This suggests that future EPSS-like systems may be evaluated not only by discrimination metrics but also by temporal admissibility and auditability [2606.19076].

Taken together, these critiques do not reject EPSS’s central role. Rather, they establish a narrower and more precise interpretation: EPSS is a strong, publicly available baseline for short-horizon exploit detection, but it is most effective when combined with impact metrics, exposure or context factors, exploitation evidence such as KEV, or architecture-aware and evidence-aware reasoning layers [2603.12450] [2508.13644].

Source: https://www.emergentmind.com/topics/exploit-prediction-scoring-system-epss