The Exploit Prediction Scoring System (EPSS) is a free, data-driven model from the Forum of Incident Response and Security Teams (FIRST) that estimates the probability a vulnerability will see exploitation activity in the wild over the next 30 days.
What an EPSS score means
Each CVE receives a score between 0 and 1, often read as a percentage. A score of 0.25 means roughly a 25% estimated chance of exploitation activity in the next 30 days. Scores are refreshed daily as new threat data arrives.
EPSS is not severity
EPSS measures likelihood, not impact. A critical-severity flaw may have a very low EPSS score if nobody is exploiting it, while a medium-severity bug can score high because attackers actively use it. That is why it complements the CVSS severity score rather than replacing it.
How to use it
- Prioritize patching: start with vulnerabilities that have both high EPSS and high impact on your assets.
- Cross-check with the CISA KEV catalog: anything listed there is already confirmed as exploited.
- Watch the trend: a sharp rise in a CVE’s score is an early warning signal.
How we use it
When Cyber Strike News covers a vulnerability, we cite the CVSS score, KEV status and, where available, the EPSS probability so you can judge real-world risk quickly.