Exploit Prediction with EPSS: What the Score Means and What It Does Not

The Exploit Prediction Scoring System (EPSS) is a data-driven model maintained by FIRST that predicts the likelihood (between 0 and 1) of a CVE being exploited in the wild within 30 days. While EPSS doesn't replace vendor advisories or consider asset context, it provides a valuable tool for prioritizing patching efforts by forecasting exploit probability. Scores are relative to a global attacker population, not a specific organization’s threat model.