Also known as: Exploit Prediction Scoring System
EPSS (Exploit Prediction Scoring System) estimates the probability that a given vulnerability will be exploited in the wild within the next 30 days, expressed as a percentage between 0 and 100.
EPSS exists because CVSS answers the wrong question for prioritisation. CVSS asks how bad exploitation would be; EPSS asks how likely exploitation is. The vast majority of published CVEs are never exploited at scale, so a severity-only queue sends teams chasing theoretical worst cases while genuinely-attacked flaws wait.
Used together, the two are complementary: high CVSS plus high EPSS is an emergency, high CVSS plus very low EPSS is often a scheduled patch. EPSS is a statistical model trained on observed exploitation data, so it is a probability estimate, not a promise.
CVSS
CVSS (Common Vulnerability Scoring System) is an open standard that scores the technical severity of a vulnerability from 0.0 to 10.0, based on factors such as attack complexity, required privileges, and impact on confidentiality, integrity, and availability.
KEV Catalog
The KEV (Known Exploited Vulnerabilities) catalog is a list maintained by the US Cybersecurity and Infrastructure Security Agency of vulnerabilities with confirmed evidence of active exploitation in the wild.
CVE
CVE (Common Vulnerabilities and Exposures) is a public catalogue that assigns a unique identifier, such as CVE-2026-31337, to each publicly disclosed software vulnerability so that everyone can refer to the same flaw unambiguously.
Vulnerability Management
Vulnerability management is the ongoing process of identifying, prioritising, remediating, and verifying fixes for security weaknesses across an organisation's systems and software.