Draft:Exploit Prediction Scoring System
 | Review waiting, please be patient.
This may take 2 months or more, since drafts are reviewed in no specific order. There are 1,793 pending submissions waiting for review.
Where to get help
How to improve a draft
You can also browse Wikipedia:Featured articles and Wikipedia:Good articles to find examples of Wikipedia's best writing on topics similar to your proposed article. Improving your odds of a speedy review To improve your odds of a faster review, tag your draft with relevant WikiProject tags using the button below. This will let reviewers know a new draft has been submitted in their area of interest. For instance, if you wrote about a female astronomer, you would want to add the Biography, Astronomy, and Women scientists tags. Editor resources
Reviewer tools
|
| Submission declined on 12 April 2025 by AstrooKai (talk). This draft includes a list of general references, but it lacks sufficient corresponding inline citations. Please improve this article by introducing more precise citations.
Where to get help
How to improve a draft
You can also browse Wikipedia:Featured articles and Wikipedia:Good articles to find examples of Wikipedia's best writing on topics similar to your proposed article. Improving your odds of a speedy review To improve your odds of a faster review, tag your draft with relevant WikiProject tags using the button below. This will let reviewers know a new draft has been submitted in their area of interest. For instance, if you wrote about a female astronomer, you would want to add the Biography, Astronomy, and Women scientists tags. Editor resources
This draft has been resubmitted and is currently awaiting re-review. |  |
| Submission declined on 12 April 2025 by AstrooKai (talk). This draft includes a list of general references, but it lacks sufficient corresponding inline citations. Please improve this article by introducing more precise citations.
Where to get help
How to improve a draft
You can also browse Wikipedia:Featured articles and Wikipedia:Good articles to find examples of Wikipedia's best writing on topics similar to your proposed article. Improving your odds of a speedy review To improve your odds of a faster review, tag your draft with relevant WikiProject tags using the button below. This will let reviewers know a new draft has been submitted in their area of interest. For instance, if you wrote about a female astronomer, you would want to add the Biography, Astronomy, and Women scientists tags. Editor resources
This draft has been resubmitted and is currently awaiting re-review. | |
Exploit Prediction Scoring System (EPSS) is an open, data-driven risk metric that estimates the probability a publicly disclosed software vulnerability will be exploited in the wild within the next 30 days.[1] Managed by the Forum of Incident Response and Security Teams (FIRST), EPSS complements the severity-focused Common Vulnerability Scoring System (CVSS) by prioritizing vulnerabilities according to real-world exploitation likelihood.[1]
Overview
EPSS produces a numerical probability between 0 and 1 (expressed as 0–100%) for every Common Vulnerabilities and Exposures (CVE) identifier listed in the National Vulnerability Database (NVD).[1] A higher score indicates a greater chance that the vulnerability will be targeted by threat actors during the next month.[1] Scores are recalculated and published daily as a downloadable data set and through an API.[2]
Mission
The Exploit Prediction Scoring System (EPSS) is a data-driven effort for estimating the likelihood that a software vulnerability will be exploited in the wild.[1] Its goal is to help network defenders prioritize remediation.[1] EPSS uses current threat information from CVE and real-world exploit data to produce a probability score between 0 and 1 (0–100%).[3] The higher the score, the greater the probability that a vulnerability will be exploited.[3]
Updates to EPSS
Version 4 (current) – released 17 March 2025[1] Version 3 – released 7 March 2023[4] Major update – 4 February 2022[4] First public scores – 7 January 2021[4] EPSS SIG formed at FIRST – April 2020[1] Original EPSS model presented at Black Hat – 2019[5]
Goals and deliverables
EPSS publishes scores for all CVEs in a public state.[2] The EPSS-SIG aims to improve the maturity of data collection and analysis to provide near-real-time assessments of all publicly disclosed vulnerabilities.[1] This requires partnerships with data providers and infrastructure for a publicly accessible interface to EPSS scores.[1] Multiple open and commercial datasets are ingested, including data identifying instances of actual exploitation (e.g., intrusion-detection systems, honeypots, network observatories, malware analysis, and other sensor networks).[3]
History
Black Hat 2019 – The original concept and prototype were presented by researchers Michael Roytman, Jay Jacobs, and Sasha Romanosky.[5]
April 2020 – FIRST chartered the EPSS Special Interest Group (SIG) to develop the model collaboratively with industry and academia.[1]
7 January 2021 – Public publication of daily EPSS scores began (model v1).[4]
4 February 2022 – Version 2 incorporated additional telemetry sources and algorithmic improvements.[4]
7 March 2023 – Version 3 introduced gradient-boosted decision trees and expanded feature sets.[4]
17 March 2025 – Version 4 became the current model, adding contextual threat-intelligence feeds and performance gains.[1]
Methodology
EPSS employs supervised machine-learning, currently using gradient-boosted trees, trained on historical exploitation events.[3] Predictive features include:
CVSS base metrics (attack vector, privileges required, etc.)[3] Availability of exploit code in public repositories or exploit kits[3] Mentions in security advisories and social-media telemetry[3] Presence of the CVE in malware campaigns or botnet traffic[3] The model is retrained periodically to incorporate new data sources and adversary behavior.[3] Performance is measured using area under the precision-recall curve (AUPRC) against a ground-truth set of confirmed exploitation incidents.[3]
Output interpretation
EPSS scores are decile-ranked: the top 1% of scores historically accounts for roughly 80% of observed exploitation activity.[2] FIRST recommends prioritizing remediation for CVEs above the 0.5 probability threshold, though organizations may choose bespoke cut-offs based on risk appetite.[1]
Adoption and usage
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) encourages network defenders to use EPSS alongside its Known Exploited Vulnerabilities Catalog when triaging patches.[6] Major vulnerability-management platforms, such as Rapid7, Tenable, and Qualys, integrate EPSS scores to drive risk-based patching workflows.[5] Academic research has leveraged EPSS to model exploit trends and evaluate proactive defenses.[7]
Comparison with other scoring systems
While CVSS quantifies the technical severity of a vulnerability, EPSS predicts exploitation likelihood.[3] Combining EPSS with CVSS can align remediation efforts with actual threat activity.[8]
See also
Common Vulnerability Scoring System (CVSS) Stakeholder-Specific Vulnerability Categorization (SSVC) National Vulnerability Database (NVD)
External links
References
- ^ a b c d e f g h i j k l m "EPSS Version 4 Released". FIRST. 17 March 2025. Retrieved 11 April 2025.
- ^ a b c "EPSS Data Statistics". FIRST. Retrieved 11 April 2025.
- ^ a b c d e f g h i j k "How the EPSS Scoring System Works". Orca Security Blog. 15 February 2023. Retrieved 11 April 2025.
- ^ a b c d e f "Understanding and Using the EPSS Scoring System". FOSSA Blog. 20 January 2023. Retrieved 11 April 2025.
- ^ a b c "What Is an EPSS Score?". Brinqa. 10 February 2024. Retrieved 11 April 2025.
- ^ Parla, Rianna (4 November 2024). "Efficacy of EPSS in High Severity CVEs Found in CISA KEV". arXiv:2411.02618 [cs.CR].
- ^ Mell, Peter; Bojanova, Irena; Galhardo, Carlos (1 May 2024). "Measuring the Exploitation of Weaknesses in the Wild". arXiv:2405.01289 [cs.CR].
- ^ Jiang, Yuning; Oo, Nay; Meng, Qiaoran; Hoon Wei Lim; Sikdar, Biplab (12 February 2025). "A Survey on Vulnerability Prioritization: Taxonomy, Metrics, and Challenges". arXiv:2502.11070 [cs.CR].