What is EPSS?
EPSS stands for Exploit Prediction Scoring System.
EPSS, or Exploit Prediction Scoring System, is a FIRST-maintained model that estimates the probability a given vulnerability will be exploited in the wild within the next 30 days, expressed as a score between 0 and 1.
In depth
Understanding EPSS
CVSS measures how bad a vulnerability would be if exploited. It does not estimate whether anyone will. That gap is why organisations working strictly from CVSS end up patching a large set of severe-but-unused vulnerabilities while something rated moderate is actively being exploited.
EPSS is empirical rather than analytical: it is trained on observed exploitation activity and updated daily, so a score moves when the real-world picture moves. The overwhelming majority of vulnerabilities score very low, which is the useful signal — it makes the small number that score high stand out.
The complementary source is the CISA Known Exploited Vulnerabilities catalogue, which is a factual record of exploitation rather than a prediction. In practice EPSS and KEV are read together: KEV says it is happening, EPSS estimates whether it is about to.
In RedStrike
How RedStrike handles EPSS
RedStrike normalizes CVSS across every tool that reports a finding, then enriches severity with CISA KEV membership and EPSS probability from its threat-intelligence integration, so a known-exploited vulnerability outranks a theoretically-worse one nobody is using.
FAQ
Frequently asked questions
Common questions about EPSS.
Should EPSS replace CVSS?
No — they measure different things and are used together. CVSS describes impact if exploited; EPSS estimates likelihood of exploitation. A high-impact, high-probability vulnerability is the one to fix first, and you need both numbers to identify it.
What is the difference between EPSS and CISA KEV?
KEV is a catalogue of vulnerabilities with confirmed exploitation — a record of fact. EPSS is a daily-updated probability estimate for vulnerabilities generally, including ones never yet exploited. Presence in KEV is the stronger signal; EPSS covers far more ground.
See EPSS in practice
Run continuous, verified security testing across your applications, APIs, and cloud accounts.