EPSS vs CVSS: Prioritizing What Actually Gets Exploited

First developed as part of our TRACE Score whitepaper, May 2026. Expanded and updated for this site.

26,000 Findings and a Team of Four

A mid-size government contractor runs their quarterly vulnerability scan and gets back 26,000 findings. Their remediation team is four people. CVSS labels 8,100 of those findings "Critical" or "High." At their current patch rate of 200 per week, clearing just the Critical/High backlog would take ten months -- by which time two more quarterly scans will have added another 16,000 findings each.

They know that most of those 8,100 high-severity findings will never be exploited. They also know that somewhere in the remaining 17,900 lower-severity findings are vulnerabilities that ransomware operators are actively weaponizing this week. CVSS cannot tell them which is which.

This is not a tooling problem. It is a prioritization model problem. And it has a solution.

Why Now: The Prioritization Crisis Is Getting Worse

NVD published 28,902 CVEs in 2023. The 2024 count exceeded 40,000. The April 2026 NVD policy change introduced accelerated publication timelines that further compress the window between disclosure and expected remediation. Meanwhile, the CISA KEV catalog -- now exceeding 1,100 entries -- shifted federal attention from severity-based timelines to evidence-of-exploitation timelines, explicitly acknowledging that CVSS alone is insufficient for remediation prioritization.

The math is unforgiving: CVE volume grows 15-20% annually. Security team headcount does not. Any organization still prioritizing purely by CVSS score is guaranteed to fall further behind every quarter, patching theoretical risks while actual exploitation happens elsewhere in their environment.

The question is no longer "should we move beyond CVSS?" The question is "what do we move to?"

What CVSS Actually Measures (and What It Does Not)

CVSS (Common Vulnerability Scoring System) assigns every vulnerability a score from 0.0 to 10.0 based on technical characteristics:

Attack vector -- network, adjacent, local, physical
Attack complexity -- low, high
Privileges required -- none, low, high
User interaction -- none, required
Impact -- confidentiality, integrity, availability (each rated none/low/high)

This produces a severity assessment: how bad could this be if exploited, under worst-case conditions, without considering your environment.

What CVSS does not measure:

Whether anyone is actually exploiting this vulnerability
Whether exploit code exists
Whether the vulnerability is reachable in your specific deployment
Whether compensating controls reduce the effective risk
Whether the affected asset handles sensitive data

A CVSS 9.8 on an air-gapped test server with no sensitive data is categorically different from a CVSS 7.2 on an internet-facing payment system with a Metasploit module available. CVSS treats them as if the first is more urgent.

What EPSS Measures

The Exploit Prediction Scoring System (EPSS), developed by FIRST (Forum of Incident Response and Security Teams), uses machine learning to estimate the probability that a vulnerability will be exploited in the wild within the next 30 days.

EPSS scores range from 0 to 1.0 (0% to 100% probability of exploitation within 30 days).

EPSS input signals include:

Whether public exploit code exists (and where -- GitHub, Metasploit, exploit-db)
Threat actor activity associated with the vulnerability
Time since disclosure (exploitation probability follows a decay curve)
Social media and dark web mentions
Vulnerability characteristics (type, affected software category)
Historical exploitation patterns for similar vulnerabilities

Key characteristics:

Dynamic -- scores update daily as new threat intelligence arrives. A vulnerability's EPSS jumps when a Metasploit module is published or when a ransomware group adopts it.
Evidence-based -- trained on observed exploitation data from IDS/IPS sensors, honeypots, and threat intelligence feeds.
Complementary to CVSS -- EPSS measures likelihood; CVSS measures impact. They answer different questions.

EPSS vs CVSS: Head-to-Head Comparison

Attribute	CVSS	EPSS
Measures	Technical severity (maximum impact)	Exploitation probability (likelihood)
Scale	0-10	0-1.0 (0%-100%)
Update frequency	Fixed at publication (base score)	Daily
Considers exploit availability	No	Yes (primary signal)
Considers threat actor activity	No	Yes
Considers your environment	No (without Environmental metrics, rarely used)	No (complements asset context)
Best for	Understanding worst-case impact	Prioritizing remediation effort
Free and public	Yes	Yes (first.org/epss)

The Illustrative Case

Consider CVE-2024-21762 (FortiOS out-of-bounds write, pre-authentication RCE):

CVSS: 9.6 (Critical)
EPSS at disclosure: 0.04 (4%)
EPSS after CISA KEV listing: 0.89 (89%)
EPSS today: 0.71 (71%)

Now consider a hypothetical CVE with a CVSS of 9.8 in an obscure protocol handler with no public exploit, no known exploitation, and complex attack prerequisites:

CVSS: 9.8 (Critical)
EPSS: 0.01 (1%)

CVSS says the second vulnerability is more severe. EPSS says the first is 71x more likely to be exploited. In a resource-constrained environment, patching FortiOS first is not even a close decision.

The Contrarian Position: EPSS Has Blind Spots Too

EPSS is not a silver bullet. It has structural limitations that practitioners must understand:

EPSS cannot predict zero-day exploitation before disclosure. By definition, it scores published CVEs. The xz backdoor (CVE-2024-3094) would have scored near-zero in its first hours despite being actively exploitable.
EPSS underweights targeted attacks. The model trains primarily on opportunistic, mass-exploitation data. A nation-state actor targeting your specific organization with a CVE that has zero broad exploitation will produce a low EPSS score.
EPSS lags initial weaponization by 24-72 hours. The score updates daily and requires observable exploitation signals. In the first hours after a new exploit drops, EPSS has not yet caught up.
EPSS does not consider your environment. A high EPSS score on software you do not run is irrelevant. A low EPSS score on software running on your most critical internet-facing system may still warrant urgent action.

These limitations do not invalidate EPSS. They define where it needs supplementation -- which is exactly why EPSS works best as one signal among several, not as a standalone prioritization mechanism.

Using EPSS and CVSS Together: The Quadrant Model

	High EPSS (> 0.1)	Low EPSS (< 0.1)
High CVSS (7+)	Patch immediately -- severe impact AND actively targeted	Patch within SLA -- severe but not currently targeted
Low CVSS (< 7)	Elevate priority -- actively targeted despite lower severity	Lowest priority -- lower impact AND unlikely to be exploited

This simple 2x2 reduces a 26,000-finding backlog to four action categories. The upper-left quadrant (high EPSS + high CVSS) typically contains 2-5% of total findings. That is your real critical workload.

Adding CISA KEV as a Third Signal

The CISA Known Exploited Vulnerabilities catalog provides confirmed exploitation data -- not prediction, but observation. When a CVE appears in the KEV, it is definitively being exploited in the wild, regardless of what EPSS predicts or CVSS scores.

The three-signal prioritization stack:

CISA KEV = confirmed exploitation. Patch within BOD 22-01 timelines (typically about three weeks from catalog addition for newly added CVEs). Non-negotiable for federal systems.
EPSS > 0.1 + CVSS 7+ = high probability of exploitation with severe impact. 7-day SLA.
EPSS > 0.1 + CVSS < 7 = likely exploited but moderate impact. 14-day SLA.
EPSS < 0.1 + CVSS 7+ = severe but unlikely to be exploited soon. 30-day SLA.
EPSS < 0.1 + CVSS < 7 = lowest priority. 90-day SLA or risk acceptance with documented justification.

This hierarchy is a starting point. Organizations with mature vulnerability management programs add asset criticality, network exposure, and compensating controls as additional dimensions. See Risk-Based Vulnerability Prioritization for the full model.

EPSS Accuracy: What the Data Shows

At a threshold of 0.1 (10% exploitation probability), EPSS captures approximately 60% of subsequently exploited CVEs while flagging only about 5% of all published CVEs for attention.

Compare this to CVSS-only prioritization: CVSS scores of 7.0+ (the "High" and "Critical" threshold) flag approximately 55-60% of all CVEs. That set also captures most exploited CVEs -- but it selects 10x more findings for the same recall rate.

Put differently: EPSS achieves comparable coverage of actually-exploited vulnerabilities while generating one-tenth the remediation workload. For a four-person team facing 26,000 findings, that is the difference between a ten-month backlog and a five-week sprint.

Implementation: Getting Started

Pull EPSS scores into your vulnerability management platform. The EPSS API is free and public (api.first.org/data/v1/epss). Scores update daily. Most commercial scanners now include EPSS natively.
Build the quadrant view. Cross-reference EPSS against CVSS for your active findings. Identify the upper-left quadrant (high EPSS + high CVSS) as your immediate action set.
Overlay CISA KEV. Any finding on the KEV supersedes the quadrant model -- it goes to the top regardless of EPSS/CVSS position.
Set SLAs by quadrant, not by CVSS alone. Adjust your patch management policy to reflect exploitation likelihood, not just theoretical severity.
Track effectiveness. Monitor which of your findings subsequently appear in KEV or threat intel feeds. If your "lowest priority" bucket keeps producing exploited CVEs, your thresholds need adjustment.

Key Takeaways

CVSS measures how bad; EPSS measures how likely. You need both. Neither is sufficient alone.

EPSS reduces the "Critical" pile by approximately 90% compared to CVSS-only thresholds while maintaining comparable coverage of actually-exploited vulnerabilities.

CISA KEV supersedes both. Confirmed exploitation is not a prediction -- it is a fact. KEV findings go to the top.

EPSS updates daily. A vulnerability that was 2% likely yesterday can be 80% likely today after a Metasploit module drops. Static prioritization is obsolete.

EPSS has blind spots on targeted attacks and first-day weaponization. Supplement with threat intel specific to your industry and attack surface.

Frequently Asked Questions

Is EPSS free to use?

Yes. EPSS scores are published daily by FIRST.org at api.first.org/data/v1/epss. The data is freely available for any use. Most commercial vulnerability management platforms now integrate EPSS natively, but you can also pull the data directly via API and correlate it with your scanner output.

How often do EPSS scores change significantly?

Most CVE scores remain relatively stable after the first 30 days post-publication. Significant jumps occur when: (1) public exploit code is released, (2) a vulnerability is added to CISA KEV, (3) threat intel feeds detect new exploitation campaigns, or (4) a vulnerability is incorporated into a commodity exploit kit or ransomware toolchain. Monitoring daily deltas across your asset inventory catches these transitions.

Does EPSS replace CVSS for compliance reporting?

No. Compliance frameworks (NIST 800-53 RA-5, FedRAMP, PCI DSS 6.3.3, CMMC) still reference CVSS for severity classification and SLA definitions. EPSS supplements CVSS for operational prioritization -- it determines remediation order within a severity tier, not whether a finding is reportable. Report by CVSS. Prioritize by EPSS. Both appear in your vulnerability management evidence.

What EPSS score threshold should we use for "high priority"?

The commonly cited threshold is 0.1 (10%), which captures the top ~5% of CVEs by exploitation likelihood. Organizations with tighter remediation capacity may raise the threshold to 0.3 or 0.5 to focus on an even smaller set. The correct threshold depends on your team's capacity: choose the value that produces a workload your team can actually clear within SLA. A threshold that generates more work than you can complete is functionally identical to no threshold at all.

How Advisedly Helps

Advisedly incorporates EPSS alongside CVSS, CISA KEV, asset criticality, and network exposure data in its TRACE Score prioritization algorithm. The platform updates EPSS scores daily across your entire vulnerability inventory, automatically re-ranking findings when exploitation probability shifts. The quadrant model is applied automatically to every scan import, surfacing the 2-5% of findings that represent actual imminent risk to your specific environment. Compliance reporting uses CVSS for framework-required severity classification while operational remediation queues use the full TRACE Score composite. Contact begin@advisedly.ai to implement risk-based vulnerability prioritization that scales with your team.