Exploitability Index
- Exploitability Index is a family of quantitative measures that assess the ease of converting vulnerabilities or weaknesses into effective exploits.
- It encompasses methods ranging from probabilistic estimates like EPSS to formal system models and game theory deviations for strategic decision-making.
- These indices support risk management by integrating observed attack data with artifact usability and temporal evidence to guide actionable security assessments.
An exploitability index is a quantitative construct intended to summarize how readily an identified weakness, vulnerability, interaction path, exploit artifact, or strategy profile can be converted into successful advantage or concrete compromise. In current literature, the term does not denote a single universal object. Vulnerability-management work uses exploitability indices as probability estimates of observed exploitation in the wild, weakness-level aggregation measures, time-varying forecasts of functional exploit development, or artifact-centered actionability scores; game theory uses exploitability to denote the gain available from unilateral deviation from a strategy profile (Jacobs et al., 2023, Mell et al., 2024, Suciu et al., 2021, Shen et al., 22 Sep 2025, Martin et al., 2023). Taken together, this literature suggests that an exploitability index is best understood as a family of measures whose meaning depends on the unit of analysis, the target event, and the evidence admissible at scoring time.
1. Conceptual scope and unit of analysis
Across the literature, exploitability indices differ first by what they score. Some are defined over individual vulnerabilities identified by CVE; some over weakness classes identified by CWE; some over explicit interaction paths in formal system models; some over exploit artifacts; and some over strategy profiles in games. The quantity being estimated also changes. In one line of work, exploitability is the probability that exploitation activity will be observed within a fixed horizon; in another, it is the fraction of influence paths that sustain a complete attack chain; in another, it is the extent to which an exploit artifact is available, functional, and easy to operationalize; in game theory, it is the sum of regret terms against best responses (Jacobs et al., 2023, Jaskolka, 2020, Shen et al., 22 Sep 2025, Martin et al., 2023).
| Construct | Unit | Target quantity |
|---|---|---|
| EPSS | CVE | Probability of observed exploitation in the next 30 days |
| PECWE | CWE | Probability that at least one mapped CVE is exploited in the next 30 days |
| Expected Exploitability | CVE | Time-varying likelihood that a functional exploit will be developed |
| AEAS actionability score | Exploit artifact / vulnerability | Availability, functionality, and setup-friction of a usable exploit |
| $\xi(\pi_n)$ in C$^2$KA | Implicit interaction path | Fraction of influence possibilities that propagate to the sink |
| $\Phi(x)$ / NashConv | Strategy profile | Total unilateral improvement available to players |
A persistent distinction in this literature is between exploitability, severity, impact, and risk. EPSS is explicitly positioned as a probability of exploitation rather than a severity score, and its authors argue that severity and exploitability should be treated as orthogonal information rather than collapsed into a single number (Jacobs et al., 2019). AEAS, by contrast, targets exploit actionability rather than in-the-wild likelihood, while the C$^2$KA exploitability measure quantifies propagation potential rather than impact severity (Shen et al., 22 Sep 2025, Jaskolka, 2020). In game theory, exploitability is again different: it is not a security property at all, but the amount by which players can improve their payoff by deviating, formalized as
$R_i(x)=\sup_{y_i\in\mathcal{X}_i}u_i(y_i,x_{-i})-u_i(x), \qquad \Phi(x)=\sum_{i\in\mathcal{I}}R_i(x),$
with $\Phi(x)=0$ at Nash equilibrium (Martin et al., 2023).
2. Vulnerability-level probabilistic exploitability
The best-known vulnerability-level exploitability index in the cited literature is EPSS, the Exploit Prediction Scoring System. The original open formulation defined exploitability as the probability that a vulnerability will be exploited in the wild within the first 12 months after public disclosure, using a logistic-regression model over public features such as vendor indicators, exploit-code availability, text-derived tags, and reference counts (Jacobs et al., 2019). In that formulation,
$\Pr[\text{exploitation}] = \frac{1}{1+e^{-\text{LogOdds}}},$
and the score was explicitly framed as a threat score rather than a complete risk score (Jacobs et al., 2019).
Later EPSS work shifted to a 30-day horizon and a centralized, community-driven XGBoost model. In that version, the target event is “any exploitation activity being observed in the next 30 days,” and the outputs are described as true probabilities rather than arbitrary ranks (Jacobs et al., 2023). The model uses time-varying features and is rescored daily; its feature inventory spans exploitation telemetry, published exploit code, public vulnerability lists, social media, offensive-security tool presence, reference metadata, CVE text features, CVSS base metrics, CWE indicators, vendor/CPE features, and vulnerability age (Jacobs et al., 2023). The 2023 paper reports that EPSS v3 achieves a precision-recall AUC of 0.7795, compared with 0.4288 for EPSS v2 and 0.051 for CVSS v3.x base score in the same evaluation setting, reinforcing the claim that exploitability prediction and severity ranking are empirically distinct tasks (Jacobs et al., 2023).
A second, more explicitly prospective vulnerability-triage formulation appears in “Compute-Budgeted Exploitability Evidence Graphs for Prospective Vulnerability Triage,” which defines exploitability scoring relative to a decision time $\tau(v)=t_{\mathrm{pub}(v)}+\Delta$ and allows only evidence timestamped at or before that time (Alpay et al., 17 Jun 2026). Evidence documents are selected under a budget $B$ and per-layer cap $\kappa$, then aggregated with severity and a smoothed CWE-conditioned prior into a calibrated risk score
$^2$0
This work is noteworthy because it treats leakage-safe prospective admissibility as part of the definition of a valid exploitability score rather than as a secondary evaluation detail (Alpay et al., 17 Jun 2026).
3. Weakness-level, path-level, and aggregated exploitability
Exploitability indices also exist above the individual-vulnerability level. “Measuring the Exploitation of Weaknesses in the Wild” defines the Probability Equation for CWE (PECWE), a weakness-level exploitability metric over CWE classes rather than CVEs (Mell et al., 2024). For weakness $^2$1 on date $^2$2, with $^2$3 the union of CVEs mapped to $^2$4 and all of its View-1003 descendants, PECWE is
$^2$5
The target event is that at least one CVE associated with weakness $^2$6 is exploited in the 30 days following $^2$7 (Mell et al., 2024). The paper evaluates weekly PECWE values for 130 View-1003 weaknesses plus two NVD pseudo-CWEs over 151 weeks and finds that only 10 weaknesses, or 8%, remained at 1.00 throughout the study, so 92% were not constantly exploited (Mell et al., 2024). This result is important because it shows that weakness-level exploitability can be dynamic, bursty, and structurally different from simple CVE frequency, even though mean PECWE is strongly correlated with CVE count.
A formally different path-level measure appears in distributed-systems modeling with Communicating Concurrent Kleene Algebra. There, exploitability is defined for an implicit interaction path $^2$8 and written $^2$9 (Jaskolka, 2020). The measure is recursive: $\Phi(x)$0 Its meaning is the fraction of ways a compromised source can influence the next agent such that the full chain of influence continues to the sink (Jaskolka, 2020). Unlike EPSS or PECWE, this is not a probabilistic estimate from observational telemetry; it is a normalized structural measure derived from a formal system specification.
A related but distinct weakness-ranking approach appears in “Measurements of the Most Significant Software Security Weaknesses.” That paper does not define a standalone exploitability index, but it shows how exploitability can be underweighted when folded into severity and combined with highly skewed frequency distributions (Galhardo et al., 2021). Its revised MSSW metric restores greater influence to severity—hence to exploitability and impact as embedded in CVSS base scores—through double-log linearization of weakness frequency (Galhardo et al., 2021). This line of work suggests that exploitability indices at the weakness level depend strongly on aggregation design and normalization choices.
4. Temporal and artifact-grounded exploitability
A separate family of exploitability indices is defined around exploit development and exploit usability rather than observed attacks. “Expected Exploitability” introduces a dynamic, time-varying estimate of the likelihood that a disclosed vulnerability will receive a functional exploit (Suciu et al., 2021). The paper treats exploitability as a random variable observed through noisy public artifacts and argues that “not exploitable” labels are systematically biased because absence of exploit evidence is not evidence of absence (Suciu et al., 2021). EE is estimated from post-disclosure evidence including PoC code, write-ups, vulnerability metadata, and social signals, with explicit methods for class- and feature-dependent label noise. At 30 days after disclosure, the paper reports 86% precision for about 60% of exploited vulnerabilities, compared with 49% precision for its best prior exploit-classifier baseline (Suciu et al., 2021). In this formulation, exploitability is not the probability of in-the-wild attacks but the probability-like expectation that a functional exploit will be developed.
AEAS, the Actionable Exploit Assessment System, shifts the target again. It defines exploit actionability through three necessary properties: exploits should be available, functional, and require minimal setup (Shen et al., 22 Sep 2025). Its feature taxonomy spans Attack Vector, Attack Complexity, Impact, Exploit Maturity, and Popularity, and the final exploit-level score is a weighted aggregation: $\Phi(x)$1 Vulnerability-level severity is then the maximum actionability score across associated exploits (Shen et al., 22 Sep 2025). Unlike EPSS, AEAS is artifact-centric rather than event-centric: it asks whether usable exploit material exists and how operationally tractable it is. Its evaluation reports an 80.9% Top-1 success rate and a 100% Top-3 success rate for surfacing at least one functional exploit among manually validated candidates, and a 91.3% match rate with expert judgments at the vulnerability level (Shen et al., 22 Sep 2025).
These two lines of work imply different exploitability semantics. EE models the emergence of functional exploits over time from public signals, while AEAS scores the operational usability of already available exploit artifacts. Both depart from severity-only vulnerability scoring, but they answer different questions.
5. Capability-graded exploitability in AI-agent benchmarks
Recent benchmark work treats exploitability as graded exploit construction capability rather than a binary success/failure outcome. ExploitBench argues that “exploitation is not a binary event” but a ladder of progressive capabilities, formalized as a 16-flag capability bitmap $\Phi(x)$2 across tiers from code coverage and crash, through V8-specific primitives, to arbitrary read/write, program-counter control, and arbitrary code execution (Lee et al., 13 May 2026). Its core contribution for exploitability measurement is the claim that crash-only success collapses the hardest and most security-relevant parts of exploitation, namely the transition from bug triggering to reusable primitives and control (Lee et al., 13 May 2026).
ExploitGym operationalizes exploitability as the ability of an AI agent to transform a known vulnerability-triggering input into a working exploit that both captures a protected flag and passes a judge verifying that the intended vulnerability was used (Wang et al., 11 May 2026). The benchmark contains 898 instances across userspace, V8, and Linux-kernel settings, with standard mitigations toggled on and off (Wang et al., 11 May 2026). Under mitigations disabled and a 2-hour timeout, the strongest reported configurations solve 157 and 120 instances respectively; with mitigations enabled, non-trivial success remains on 37 userspace, 20 V8, and 12 kernel tasks across all models combined (Wang et al., 11 May 2026). This benchmark therefore measures exploitability as observed exploit-conversion difficulty under a specific attacker model, tool stack, and hardening regime.
FORGE replaces binary exploit generation with a four-level graduated taxonomy: L0 no evidence, L1 triggered, L2 exploited, L3 compromised (Shaikh, 2 Jun 2026). On 603 CVEs from the CVE-GENIE dataset, it reports 67.8% end-to-end L1+ exploitation at a mean cost of \$1.50 per CVE, with 91.9% of exploited CVEs falling at L1–L2 rather than full compromise (Shaikh, 2 Jun 2026). The paper also finds near-zero Spearman correlation between exploitation depth and EPSS or CVSS, with $\Phi(x)$3 for EPSS and $\Phi(x)$4 for CVSS (Shaikh, 2 Jun 2026). This suggests that graduated exploitability depth is measuring something largely orthogonal to metadata-based prioritization scores.
6. Disagreement, evaluation protocol, and limitations
Exploitability indices disagree because they are optimized for different constructs. A 2025 empirical comparison of CVSS, SSVC, EPSS, and Microsoft’s Exploitability Index on 600 Microsoft Patch Tuesday vulnerabilities reports “significant disparities” in how the four systems rank the same vulnerabilities and how they allocate them to triage tiers (Koscinski et al., 19 Aug 2025). The study therefore reinforces a recurring point in the literature: exploitability, severity, risk, and decision urgency are not interchangeable targets.
Evaluation protocol is equally consequential. The prospective evidence-graph paper shows that naive random splitting with unfiltered evidence inflates apparent prospective recall by 8.5x and EPSS-high recall by 5.0x, while a strong cross-encoder reranker lowers prospective recall because semantic relevance to a CVE is not the same as evidence of exploitation (Alpay et al., 17 Jun 2026). This result generalizes beyond that specific method: any Exploitability Index evaluated with post-decision or post-exploitation evidence can appear far more accurate than it would be in actual triage.
The literature also identifies substantial construct-specific limitations. EPSS and PECWE are both tied to observed exploitation signals and therefore inherit sensor bias, public-data incompleteness, and temporal shifts in underlying models (Jacobs et al., 2023, Mell et al., 2024). AEAS depends on the availability and analyzability of exploit artifacts and can miss runtime-only properties of exploit functionality (Shen et al., 22 Sep 2025). ExploitGym and FORGE measure exploitability in generated or benchmarked environments and therefore capture attacker- or pattern-conditioned exploitability rather than universal deployment-specific risk (Wang et al., 11 May 2026, Shaikh, 2 Jun 2026).
Taken together, these results support a precise but plural understanding of the term. An exploitability index is not a single settled metric; it is a class of measurements that quantify different aspects of exploit conversion under different evidentiary regimes. The central technical questions are therefore not only how to score, but also what is being scored, at what time, from which evidence, and for which operational decision.