Jump to content

Draft:Exploit Prediction Scoring System

From Wikipedia, the free encyclopedia


Exploit Prediction Scoring System (EPSS) is an open, data‐driven risk metric that estimates the probability a publicly disclosed software vulnerability will be exploited in the wild within the next 30 days.[1] Managed by the Forum of Incident Response and Security Teams (FIRST), EPSS complements the severity‐focused Common Vulnerability Scoring System (CVSS) by prioritizing vulnerabilities according to real‑world exploitation likelihood.[1]

Overview

[edit]

EPSS produces a numerical probability between 0 and 1 (expressed as 0–100%) for every Common Vulnerabilities and Exposures (CVE) identifier listed in the National Vulnerability Database (NVD).[1] A higher score indicates a greater chance that the vulnerability will be targeted by threat actors during the next month.[1] Scores are recalculated and published daily as a downloadable data set and through an API.[2]

Mission

[edit]

The Exploit Prediction Scoring System (EPSS) is a data‐driven effort for estimating the likelihood that a software vulnerability will be exploited in the wild.[1] Its goal is to help network defenders prioritize remediation.[1] EPSS uses current threat information from CVE and real‑world exploit data to produce a probability score between 0 and 1 (0–100%).[3] The higher the score, the greater the probability that a vulnerability will be exploited.[3]

Updates to EPSS

[edit]

Version 4 (current) – released 17 March 2025[1] Version 3 – released 7 March 2023[4] Major update – 4 February 2022[4] First public scores – 7 January 2021[4] EPSS SIG formed at FIRST – April 2020[1] Original EPSS model presented at Black Hat – 2019[5]

Goals and deliverables

[edit]

EPSS publishes scores for all CVEs in a public state.[2] The EPSS‐SIG aims to improve the maturity of data collection and analysis to provide near‐real‑time assessments of all publicly disclosed vulnerabilities.[1] This requires partnerships with data providers and infrastructure for a publicly accessible interface to EPSS scores.[1] Multiple open and commercial datasets are ingested, including data identifying instances of actual exploitation (e.g., intrusion-detection systems, honeypots, network observatories, malware analysis, and other sensor networks).[3]

History

[edit]

Black Hat 2019 – The original concept and prototype were presented by researchers Michael Roytman, Jay Jacobs, and Sasha Romanosky.[5]

April 2020 – FIRST chartered the EPSS Special Interest Group (SIG) to develop the model collaboratively with industry and academia.[1]

7 January 2021 – Public publication of daily EPSS scores began (model v1).[4]

4 February 2022 – Version 2 incorporated additional telemetry sources and algorithmic improvements.[4]

7 March 2023 – Version 3 introduced gradient‑boosted decision trees and expanded feature sets.[4]

17 March 2025 – Version 4 became the current model, adding contextual threat‑intelligence feeds and performance gains.[1]

Methodology

[edit]

EPSS employs supervised machine‑learning, currently using gradient‑boosted trees, trained on historical exploitation events.[3] Predictive features include:

  • CVSS base metrics (attack vector, privileges required, etc.)[3]
  • Availability of exploit code in public repositories or exploit kits[3]
  • Mentions in security advisories and social‑media telemetry[3]
  • Presence of the CVE in malware campaigns or botnet traffic[3]
  • The model is retrained periodically to incorporate new data sources and adversary behavior.[3]

Performance is measured using area under the precision‑recall curve (AUPRC) against a ground‑truth set of confirmed exploitation incidents.[3]

Output interpretation

[edit]

EPSS scores are decile‑ranked: the top 1% of scores historically accounts for roughly 80% of observed exploitation activity.[2] FIRST recommends prioritizing remediation for CVEs above the 0.5 probability threshold, though organizations may choose bespoke cut‑offs based on risk appetite.[1]

Adoption and usage

[edit]

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) encourages network defenders to use EPSS alongside its Known Exploited Vulnerabilities Catalog when triaging patches.[6] Major vulnerability‑management platforms, such as Rapid7, Tenable, and Qualys, integrate EPSS scores to drive risk‑based patching workflows.[5] Academic research has leveraged EPSS to model exploit trends and evaluate proactive defenses.[7]

Comparison with other scoring systems

[edit]

While CVSS quantifies the technical severity of a vulnerability, EPSS predicts exploitation likelihood.[3] Combining EPSS with CVSS can align remediation efforts with actual threat activity.[8]

See also

[edit]
[edit]

Official website

References

[edit]

[9]

[10]

[11]

[12]

[13]

[14]

[15]

[16]

[17]

[4]

[3]

[18]

[19]

[1]

[20]

[21]

  1. ^ a b c d e f g h i j k l m n "EPSS Version 4 Released". FIRST. 17 March 2025. Retrieved 11 April 2025. Cite error: The named reference "FIRST2025" was defined multiple times with different content (see the help page).
  2. ^ a b c "EPSS Data Statistics". FIRST. Retrieved 11 April 2025.
  3. ^ a b c d e f g h i j k l "How the EPSS Scoring System Works". Orca Security Blog. 15 February 2023. Retrieved 11 April 2025. Cite error: The named reference "Orca2023" was defined multiple times with different content (see the help page).
  4. ^ a b c d e f g "Understanding and Using the EPSS Scoring System". FOSSA Blog. 20 January 2023. Retrieved 11 April 2025. Cite error: The named reference "FOSSA2023" was defined multiple times with different content (see the help page).
  5. ^ a b c "What Is an EPSS Score?". Brinqa. 10 February 2024. Retrieved 11 April 2025.
  6. ^ Parla, Rianna (4 November 2024). "Efficacy of EPSS in High Severity CVEs Found in CISA KEV". arXiv:2411.02618 [cs.CR].
  7. ^ Mell, Peter; Bojanova, Irena; Galhardo, Carlos (1 May 2024). "Measuring the Exploitation of Weaknesses in the Wild". arXiv:2405.01289 [cs.CR].
  8. ^ Jiang, Yuning; Oo, Nay; Meng, Qiaoran; Hoon Wei Lim; Sikdar, Biplab (12 February 2025). "A Survey on Vulnerability Prioritization: Taxonomy, Metrics, and Challenges". arXiv:2502.11070 [cs.CR].
  9. ^ A Visual Exploration of Exploits in the Wild (PDF) (Report). Cyentia Institute. 2024. Retrieved 14 April 2025.
  10. ^ "Healthcare and Public Health Sector Vulnerability Mitigation Guide" (PDF). Cybersecurity and Infrastructure Security Agency. 2023. Retrieved 14 April 2025.
  11. ^ "Machine Learning Improves Prediction of Exploited Vulnerabilities". Dark Reading. 7 March 2023. Retrieved 14 April 2025.
  12. ^ "EPSS Integration Expands Across Vulnerability‑Management Vendors". Dark Reading. 2 April 2025. Retrieved 14 April 2025.
  13. ^ A Visual Exploration of Exploits in the Wild (Report). Cyentia Institute. 2024. Retrieved 14 April 2025.
  14. ^ "Healthcare and Public Health Sector Vulnerability Mitigation Guide" (PDF). Cybersecurity and Infrastructure Security Agency. 2023. Retrieved 14 April 2025.
  15. ^ 2024 Data Breach Investigations Report (PDF) (Report). Verizon. 2024. Retrieved 14 April 2025.
  16. ^ "The Exploit Prediction Scoring System: What It Is and How to Use It". Graylog Blog. 19 February 2024. Retrieved 14 April 2025.
  17. ^ "Explained: The Exploit Prediction Scoring System (EPSS)". Claroty Blog. 6 June 2024. Retrieved 14 April 2025.
  18. ^ "Exploring the Exploit Prediction Scoring System". Orange Cyberdefense Blog. 28 September 2024. Retrieved 14 April 2025.
  19. ^ "Assessing Vulnerability Risks with EPSS". CMS Information Security Blog. 8 January 2024. Retrieved 14 April 2025.
  20. ^ "EPSS Model Overview". FIRST. Retrieved 14 April 2025.
  21. ^ "EPSS Special Interest Group Portal". FIRST. Retrieved 14 April 2025.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Draft:Exploit_Prediction_Scoring_System&oldid=1285665000"