Why EPSS?
EPSS is the first widely deployed vulnerability prioritization system built on observed attacker behavior and a continuous empirical feedback loop. It began as a relatively simple logistic regression model, documented in the original peer-reviewed EPSS paper, and has evolved through five major versions. Each iteration improves on the previous by expanding on the variety of sources and more data, as well as an ever-expanding collection of real-world exploitation outcomes. EPSS has operated continuously at scale, retrained on new exploitation data, and published versioned methodology for years is a qualitatively different kind of artifact than a scoring rubric constructed once and published.
The problem with judgment and unvalidated models
A scoring system that is not grounded in outcome data is simply adding structure to an assertion. The inputs may be chosen thoughtfully, the rubric may (or may not) be internally consistent, and domain experts may profess its validity. But none of that establishes that the output tracks what it claims to measure. The only way to know whether an approach is useful is to collect real world observations of outcomes and then to measure it. Without labeled outcomes and a validation procedure, a scoring system can produce confident outputs while being systematically disconnected from the phenomenon it claims to quantify. Internal coherence and face validity are not substitutes for predictive validity.
Vulnerability exploitation is a domain where the conditions for reliable human judgment are especially poor. The environment is dynamic and adversarial. The signals that predict exploitation are subtle yet numerous and they interact in complex ways that resist a simple, intuitive mapping. Feedback is delayed, incomplete, systematically biased and evidence of exploitation may go undetected for years. Basically, the lessons that would allow a practitioner's mental model to self-calibrate rarely arrives in usable form or on time.
The field of judgment and decision-making has accumulated strong evidence on what happens when humans make predictions in complex domains without clear opportunities to learn. Kahneman and Klein, who come from opposing research traditions on expert intuition, identified the necessary conditions for expert judgment to be reliable in a joint paper: a high-validity environment and rapid, unambiguous feedback — what Kahneman calls the "illusion of validity" in Thinking, Fast and Slow (ch. 20). Basically, when the feedback loop is broken, our intuition cannot self-correct. Vulnerability exploitation is a low-validity environment with untimely and often ambiguous feedback and opportunities to update our understanding is sparse. A scoring rubric that feels internally coherent can produce this illusion of validity and create confident outputs that simple track the builder's beliefs rather than attacker behavior.
EPSS was built for this environment. The score does not reflect an analyst's judgment about what a reasonable attacker would do. It reflects patterns extracted from the evolving practices of attackers through observed exploitation telemetry. EPSS is being retrained annually, and in the uncertain age of AI, we are monitoring for increased "drift" in the model performance, fully expecting to retrain more than annually.
The problem is quantifiable
The CVE population is large and growing. The fraction of known vulnerabilities exploited in any 30-day window is in the low single-digit percent. An organization remediating without a clear feedback loop is going to spend most of its remediation capacity on vulnerabilities that will never be attacked in any time horizon that matters.
EPSS assigns a probability of exploitation across the entire CVE population. This reorders the vulnerabilities based on hundreds of observable characteristics of the threat environment as well as characteristics of the vulnerabilities and how well they help describe and predict the observable outcome of exploitation activity. This reordering has large consequences for how much effort is required to achieve a given level of coverage and can be observed in the plot below. Vulnerabilities are ordered left-to-right along the x-axis by descending EPSS score. The vertical y-axis shows the cumulative fraction of exploited CVEs captured over the next 30 days (the EPSS scores are 30 days old in this plot). The EPSS curve rises steeply at the left, the top-ranked CVEs are heavily concentrated among those that go on to be exploited. Addressing a small fraction of the population by EPSS score captures a disproportionately large share of realized exploitation. The evidence of a good prediction is measurable.
Calibration and the power of probability
EPSS scores are calibrated probabilities. CVEs scoring near 5% are exploited approximately 5% of the time in aggregate. CVEs scoring near 30% are exploited approximately 30% of the time.
Calibration is a testable empirical property, not a design aspiration, and it has concrete operational consequences. A calibrated score is interpretable as a statement about frequency. If your environment contains 500 CVEs scoring near 10%, you should expect roughly 50 exploitation events among them in the next 30 days — not as a guarantee for any individual CVE, but as a reliable aggregate estimate. This allows EPSS to support portfolio-level reasoning about expected exploitation load, not just rank-ordering of individual vulnerabilities.
When the score is a calibrated probability, values can be combined across vulnerabilities to estimate the probability that at least one vulnerability on a host (or environment) will be have observed exploitation activity. It's the inverse of nothing being exploited: Prob(at least one exploited) = 1 – Prob(none are exploited). Or you can estimate how many vulnerabilities in an aggregation would observe exploitation activity by summing up the probability. These types of calculations requires a calibrated probability as input. These are not possible with an ordinal numeric score or Critical, high, medium, and low values.
Score dynamics add a further dimension. EPSS updates daily. A score that moves from 2% to 40% over the course of a week reflects changing conditions in the threat environment. Perhaps new exploit code was published, new tooling supports easier discovery, new threat intelligence signals an interest in the product or even the specific vulnerability. That movement is itself a signal. A static score assigned at disclosure time cannot detect it.
What the score is built on
EPSS synthesizes approximately 2,800 features: exploitation telemetry from multiple commercial and open-source partners, threat intelligence signals, exploit code availability across public repositories, natural language attributes extracted from descriptions of vulnerabilities, vendor and product characteristics, and weakness classifications. The model is an XGBoost classifier trained on roughly 120 million rows of historical data against over 1.6 million daily observations of exploitation activity.
No analyst reviewing vulnerabilities manually can integrate signals at this breadth and consistency. The model does not tire, does not overemphasize the latest headline, and does not apply different standards on repeat evaluation. That consistency is part of its value.
An honest treatment of unobserved exploitation
Most vulnerabilities spend their entire existing without any observed exploitation record. Undoubtedly some of those are not detected because exploitation is systematically under-observed. Honeypots, IDS sensors, and threat feeds observe some proportion of the activity it should. A naive approach treats "no observed exploitation" as "no exploitation" and the two are very different. Many approaches treat a list of Known Exploited Vulnerabilities as the list of exploited. Any model built that way, will absolutely produce a model that is confidently wrong about the CVEs that are exploited and unobserved.
EPSS uses a positive-unlabeled training framework. CVEs without observed exploitation are treated as unknown, not as confirmed non-exploited. Absence of observed exploitation is not evidence of absence of exploitation. Getting this assumption right is what makes the probability output honest: the score reflects empirical likelihood given everything the model can observe, with appropriate uncertainty about what it cannot.
EPSS is supported by the EPSS Special Interest Group at FIRST. Scores are generated by Empirical Security and published freely to the community.
