Research
EPSS is grounded in peer-reviewed research and continues to be studied by independent researchers. This page lists the foundational papers, independent academic evaluations, related metrics, and presentations.
Peer-reviewed papers
Jacobs, J., Romanosky, S., Edwards, B., Roytman, M., Adjerid, I. (2021). Exploit Prediction Scoring System (EPSS). Digital Threats: Research and Practice, 2(3). (paper)
The original peer-reviewed description of EPSS, formalizing the model as the first open, data-driven framework for estimating the probability that a vulnerability will be exploited in the wild. This paper is describing EPSS Version 1, originally developed 2018-2019. An earlier version is available as a (preprint).
Jacobs, J., Romanosky, S., Adjerid, I., Baker, W. (2020). Improving Vulnerability Remediation Through Better Exploit Prediction. Journal of Cybersecurity, 6(1), tyaa015. (paper)
A paper published before EPSS and shows some early work that led to EPSS. It constructs and compares vulnerability remediation strategies on the coverage/efficiency tradeoff, using observed exploitation in the wild as the outcome measure rather than published proof-of-concept exploit code.
Jacobs, J., Romanosky, S., Suciu, O., Edwards, B., Sarabi, A. (2023). Enhancing Vulnerability Prioritization: Data-Driven Exploit Predictions with Community-Driven Insights. 2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), Delft, Netherlands, pp. 194-206. (paper)
This paper is update to the original "Exploit Prediction Scoring System (EPSS)" paper and is describing and discussing EPSS Version 3, many of the techniques are still used in Version 5 today.
Independent academic publications
For reference here are some suggestions on evaluating scoring systems
Suciu, O., Nelson, C., Lyu, Z., Bao, T., Dumitraș, T. (2022). Expected Exploitability: Predicting the Development of Functional Vulnerability Exploits. 31st USENIX Security Symposium (USENIX Security 22), Boston, MA, pp. 377-394. (paper)
Iannone, E., Sellitto, G., Iaccarino, E., Ferrucci, F., De Lucia, A., Palomba, F. (2024). Early and Realistic Exploitability Prediction of Just-Disclosed Software Vulnerabilities: How Reliable Can It Be? ACM Transactions on Software Engineering and Methodology, 33(1), 1-41. (paper)
Mahbub, M., Khan, M.S.A., Hamid, T., Mia, M.S. (2024). A Novel Vulnerability Exploit Prediction System Using the Relational Vulnerability-Vendor Network. Digital Threats: Research and Practice, 6(2). (paper)
Parla, R. (2024). Efficacy of EPSS in High Severity CVEs found in CISA KEV. Not peer reviewed. (preprint)
Koscinski, V., Nelson, M., Okutan, A., Falso, R., Mirakhorli, M. (2025). Conflicting Scores, Confusing Signals: An Empirical Study of Vulnerability Scoring Systems. Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security (CCS '25), Taipei, Taiwan. (paper)
Mell, P., Spring, J. (2025). Likely Exploited Vulnerabilities: A Proposed Metric for Vulnerability Exploitation Probability. NIST Cybersecurity White Paper (CSWP) 41. National Institute of Standards and Technology, Gaithersburg, MD. (paper)
Ravalico, D., Farina, M., Trevisan, M., Bartoli, A. (2025). Analysing the Temporal Dynamics of the Exploit Prediction Scoring Systems (EPSS). University of Trieste. Not peer reviewed. (preprint)
Presentations and talks
Jacobs, J., Romanosky, S., Edwards, B., Roytman, M., Adjerid, I. (2019). Exploit Prediction Scoring System (EPSS). 2019 Workshop on the Economics of Information Security (WEIS), Boston, June 3-4, 2019.
Jacobs, J., Romanosky, S., Edwards, B., Roytman, M., Adjerid, I. (2019). Improving Vulnerability Remediation Through Better Exploit Prediction. PrivacyCon, Federal Trade Commission, June 27, 2019. (paper)
Roytman, M., Jacobs, J. (2019). Predictive Vulnerability Scoring System. Black Hat USA, Las Vegas, August 3-8, 2019. (paper)
Jacobs, J., Romanosky, S., Edwards, B., Roytman, M., Adjerid, I. (2021). Exploit Prediction Scoring System. TPRC, The Research Conference on Communications, Information, and Internet Policy, February 19, 2021. (paper)
Romanosky, S., Jacobs, J. (2023). EPSS evolution, findings, and future directions. 35th Annual FIRST Conference, 2023. (video)
Jacobs, J., Romanosky, S., Suciu, O., Edwards, B., Sarabi, A. (2023). Enhancing Vulnerability Prioritization: Data-Driven Exploit Predictions with Community-Driven Insights. Presented at the 22nd Workshop on the Economics of Information Security (WEIS 2023), June 2023. (paper)
Jacobs, J. (2024). EPSS with Jay Jacobs. Open Source Security Podcast, Episode 445, September 2024. (podcast)
Jacobs, J. (2025). State of EPSS and What to Expect from Version 4. FIRST VulnCon 2025, Raleigh, NC, April 8, 2025. (video)
Shaffer, S., Beardsley, T., Cluck, B. (2026). The New Rules of Risk: EPSS v5 and Agentic Adversaries. runZero Hour, January 2026. (podcast)
Shaffer, S. (2026). Quantifying Swiss Cheese, the Bayesian Way. FIRST VulnCon 2026, April 13, 2026. (blog, video)
EPSS is maintained by the EPSS Special Interest Group at FIRST. Scores are generated by Empirical Security and published freely to the community.
