EPSS — the Exploit Prediction Scoring System — is an open, data-driven model that estimates the probability a given CVE will be exploited in the wild within the next 30 days. Unlike CVSS, which measures theoretical severity, EPSS measures likelihood of real-world exploitation. That single shift lets security teams stop chasing every high-CVSS finding and focus remediation effort on vulnerabilities attackers are actually using right now.
CVSS (Common Vulnerability Scoring System) has been the default for decades. It scores a vulnerability's inherent characteristics — attack complexity, privileges required, impact — on a 0–10 scale. The problem: a CVE can score a 9.8 and never be exploited in the wild, while a 6.5 sits inside a public exploit kit actively targeting your industry.
Using CVSS alone, a typical organisation faces hundreds of "critical" findings at any time. Triage becomes guesswork. EPSS adds a probability score between 0.0 and 1.0 (or 0%–100%) that is recalculated daily using real threat intelligence — exploit code availability, proof-of-concept publications, attacker chatter, and observed exploitation data from sources like Shadowserver and GreyNoise.
The EPSS model is maintained by FIRST (Forum of Incident Response and Security Teams). Here is how it operates:
EPSS pairs powerfully with the CISA Known Exploited Vulnerabilities (KEV) catalogue. KEV is a confirmed list — CVEs CISA has verified are being exploited. EPSS is predictive. Together they give you two lenses:
This two-axis framework is now considered best practice in vulnerability management and is referenced in guidance from CISA, NIST, and major security frameworks.
Effective prioritization combines at least three signals:
Layering these signals reduces the patch backlog dramatically. Research consistently shows that fewer than 5% of published CVEs ever see active exploitation — EPSS helps you find that 5% before attackers find you.
Pinaka is an AI-powered External Attack Surface Management platform that continuously maps everything exposed on your domain — subdomains, open ports, cloud assets, exposed secrets, and services — then correlates every finding with CVE intelligence, including EPSS scoring and CISA KEV tracking.
Rather than handing you a raw list of thousands of CVEs, Pinaka combines EPSS probability, KEV confirmation, and its own AI-powered exposure scoring to surface a ranked, prioritised list of what an attacker can actually exploit against your specific attack surface. Monitoring runs every six hours, meaning EPSS score spikes — when a newly published exploit pushes a CVE's probability up sharply — are caught in near-real-time, not weeks later.
Key capabilities relevant to CVE prioritization:
You can run a free security check on your domain at pinaka.sh — no signup required, results in under a minute.
There is no universal threshold, but many security teams treat EPSS scores above 0.10 (10%) as elevated priority and anything above 0.50 (50%) as urgent — especially when the CVE is also present on an internet-exposed asset. Combine the score with KEV status and your own asset context before deciding.
EPSS scores are recalculated and published daily by FIRST. A CVE's score can shift significantly overnight if a new public exploit or active exploitation campaign is detected, which is why real-time or near-real-time correlation matters in practice.
No. They measure different things. CVSS measures potential impact and exploitability characteristics. EPSS measures the probability of real-world exploitation. Best practice is to use both: CVSS to understand what the blast radius looks like, EPSS to understand how urgent remediation is.
The CISA Known Exploited Vulnerabilities catalogue is a confirmed list of CVEs that have been observed in active exploitation. EPSS is predictive. A CVE in the KEV catalogue has confirmed exploitation; a CVE with a high EPSS score is statistically likely to join it soon. Using both together gives you the most complete picture of exploitation risk.
Pinaka correlates every discovered vulnerability against live CVE intelligence including EPSS probabilities and CISA KEV status, then layers in its own AI-powered exposure scoring that accounts for whether the vulnerable asset is actually reachable from the internet. This means you get a prioritised list based on your real-world risk — not just global statistics. Learn more at pinaka.sh.