EPSS (Exploit Prediction Scoring System)
EPSS (Exploit Prediction Scoring System) is a data-driven model that estimates the probability, from 0 to 1, that a given vulnerability will be exploited in the wild within the next 30 days, helping teams prioritize the flaws most likely to be attacked.
EPSS, maintained by FIRST, is a machine-learning model that outputs a daily-updated probability score between 0 and 1 for each CVE, representing the likelihood of observed exploitation activity in the next 30 days. It also publishes a percentile so you can see how a CVE ranks relative to all others.
The model is trained on real-world signals — exploit code availability, vulnerability characteristics, references, and observed attack telemetry — rather than on the intrinsic severity of the flaw. Because scores refresh daily, a vulnerability's EPSS can rise quickly once a public exploit appears and attack traffic increases.
For developers, EPSS answers a question CVSS cannot: 'how likely is this to actually be attacked?' Most CVEs are never exploited, so filtering or ranking by EPSS lets teams focus remediation effort on the small fraction of vulnerabilities that carry real-world exploit risk, instead of treating every High/Critical CVSS finding as equally urgent.