The Exploit Prediction Scoring System estimates the probability that a published vulnerability will be exploited in the wild during the next 30 days. It is a dated forecast about vulnerability exploitation, not a probability that your particular organization will be breached.
What it is
EPSS is a data-driven forecast associated with a vulnerability identifier. Its probability concerns exploitation in the wild over the next 30 days. The score does not describe the chance that a specific asset is affected, exposed or successfully attacked. Those are separate questions requiring local evidence.
EPSS is also different from severity. A vulnerability can have severe potential consequences but a lower forecast probability, or a higher probability while affecting a more limited function. Using both signals can be useful precisely because they describe different dimensions.
How it works
The model uses available vulnerability and exploitation-related information to produce a probability estimate. Scores are published over time and can change as information or the model changes. An operational record should retain the date and source of the value used in a decision.
Probability and percentile
The probability is the forecast value. The percentile shows where that value ranks relative to other scored vulnerabilities. A score in a high percentile can still have a probability that is numerically much lower than the percentile. Dashboards should label these values clearly rather than displaying one ambiguous percentage.
Forecast horizon matters
A forecast for the next 30 days is not a lifetime probability and should not be described as one. A score retrieved months ago may no longer reflect current information. Revisit important findings when intelligence changes rather than keeping the initial value permanently attached to the priority.
Model output is not complete observation
A prediction can be useful without being certain. Exploitation telemetry has limits, and the organization’s own environment may have relevant evidence the model does not represent. Missing or low scores should not erase confirmed local activity or known exploitation evidence from other reliable sources.
Technical references: FIRST · EPSS Frequently Asked Questions · FIRST · Using EPSS
How attackers use it
EPSS is a defensive prioritization signal based on patterns associated with exploitation. It does not cause exploitation or provide a complete description of an attack. An attacker can still target a vulnerability with a low forecast if it fits an available path.
For defenders, the question is how the forecast changes the next action. It may help order a set of confirmed applicable findings, but should not replace applicability checks or the response to credible evidence that a consequential vulnerability is already being exploited.
Warning signs
Review reports that label EPSS as breach probability, confuse percentile with probability or omit the score date. Investigate automated rules that close findings solely because a probability falls below a threshold. The organization may be discarding other evidence without realizing it.
Interpret changes carefully
A rising score can justify renewed review, but it is not proof that your asset was attacked during the interval. A falling score does not establish that the weakness was fixed. Keep the intelligence timeline separate from the asset’s configuration and remediation timeline.
Business impact
EPSS can help teams allocate limited remediation capacity, especially when many confirmed findings compete for attention. Misinterpretation can create false confidence or exaggerated urgency. The value comes from using the forecast within a transparent decision process.
Measure the quality of decisions and verified risk reduction, not merely whether a queue contains high scores. A team can reduce a probability-ranked backlog while leaving an important unscored or locally exploited condition unresolved.
Prevention and remediation
Use dated EPSS values alongside severity, known exploitation and asset context. Document any thresholds as a triage aid, with exceptions for credible activity and consequential exposure. Review the decision when scores, applicability or deployment conditions change.
A responsible use pattern
- Confirm that the vulnerability applies to the asset. - Record the probability, percentile and observation date distinctly. - Check for known exploitation and relevant local evidence. - Evaluate the access path and business consequences. - Select an action and preserve the reasoning. - Reassess unresolved findings when material evidence changes.
EPSS is not a remediation mechanism. A patch, configuration change or access restriction alters the asset; a forecast update alters the intelligence. Closure should be supported by evidence of the former, not by a favorable movement in the latter.
How Ariema detects or handles it
Ariema’s possible vulnerability matches and external observation context can help identify which asset needs applicability review. That context can be used alongside a verified EPSS value when the team performs prioritization.
The documented capabilities do not establish automatic ingestion or calculation of every EPSS score. Preserve the authoritative source and date when using the signal. Ariema’s follow-up and retest evidence can document the actual asset change, which remains separate from the forecast.
Common questions
Is the percentile the same as the probability?
No. Probability is the model’s forecast. Percentile describes the score’s position relative to other scored vulnerabilities. A high percentile does not mean the same numerical percentage chance of exploitation.
Does low EPSS mean a vulnerability is safe to ignore?
No. Applicability, known exploitation, business impact and local evidence may justify action independently of the forecast.
Does EPSS predict the impact of an exploit?
No. It addresses exploitation probability in the wild over its forecast horizon, not severity or the consequences for a particular deployment.
Sources & further reading
Primary technical references for this guide. Scenarios are illustrative; they are not customer observations.
FIRST · EPSS Frequently Asked QuestionsFIRST · Using EPSS