EPSS score tells you how likely a vulnerability is to get exploited in the next 30 days, and pairing it with CVSS severity is the fastest way to cut a 10,000-CVE backlog down to the 50 that actually matter in 2026.
- EPSS score ranges 0 to 1 and predicts 30-day exploitation probability, not damage potential.
- Combine EPSS with CVSS and asset exposure — EPSS alone misses business context.
- EPSS v4, released by FIRST.org in 2025, updates daily; static exports go stale fast.
- Fewer than 5% of published CVEs are ever exploited in the wild, so EPSS filters noise CVSS can't.
- Brinqa's exposure management platform automates EPSS ingestion and pairs it with asset criticality.
Why this matters
CVSS tells you how bad a vulnerability could be. It says nothing about whether anyone is actually exploiting it. Security teams patching by CVSS severity alone end up fixing thousands of 9.8-rated CVEs that no attacker has ever touched, while a 6.5-rated CVE with active exploitation sits untouched in the queue.
EPSS score fixes that gap by adding a probability layer. It's a machine-learning model maintained by FIRST.org that scores every published CVE from 0 to 1 based on the likelihood of exploitation activity within 30 days. A score of 0.89 means an 89% chance of observed exploitation in that window; a score of 0.02 means it's almost certainly going to sit unused. Vulnerability management teams that blend EPSS score with CVSS and asset exposure routinely cut remediation volume by an order of magnitude without increasing risk. Brinqa's platform builds this exact workflow into its exposure management pipeline, so scores refresh daily instead of going stale in a spreadsheet.
What you'll need
- A current vulnerability scan export with CVE identifiers (from your scanner, not a six-month-old spreadsheet)
- Access to the FIRST.org EPSS API or the daily CSV feed
- CVSS base and, ideally, temporal scores for the same CVE set
- An asset inventory that flags internet-facing systems, crown-jewel data stores, and segmentation status
- The CISA Known Exploited Vulnerabilities (KEV) catalog for cross-validation
- 30-60 minutes for the first pass; automated refreshes after that take minutes
The steps
1. Pull your full CVE inventory
Export every open vulnerability finding with its CVE ID, affected asset, and CVSS score. This is your working set — you can't score what you haven't inventoried. Expect this list to run into the thousands for any org with more than a few hundred assets. Common mistake: exporting only "critical" and "high" CVSS findings and missing medium-severity CVEs that carry a high EPSS score.
2. Match each CVE to its current EPSS score
Query the FIRST.org EPSS API (or download the daily CSV) and join it to your CVE list by identifier. EPSS scores update every 24 hours, so a static join done in January will drift by 2026's mid-year patch cycle. Expected outcome: every CVE in your set now carries a score between 0.00 and 1.00, alongside its EPSS percentile ranking against all scored CVEs. Common mistake: joining on outdated EPSS snapshots pulled once and never refreshed.
3. Set a risk threshold, not a fixed number
Don't chase a single cutoff like "EPSS above 0.1." Use percentile instead — the top 1% of EPSS-scored CVEs accounts for a disproportionate share of real-world exploitation activity, based on FIRST.org's published research. Teams with mature programs often triage the top 5-10% by percentile as the active remediation queue. Common mistake: setting the threshold too low and drowning the queue in thousands of "medium probability" CVEs that never move the needle.
4. Cross-reference with CVSS and asset exposure
EPSS score alone ignores blast radius. A CVE with a 0.75 EPSS score on an air-gapped test server is lower priority than a 0.35 EPSS score on an internet-facing production database. Layer asset criticality and network exposure on top of the EPSS-CVSS pair before you rank anything. Expected outcome: a three-dimensional priority score (EPSS x CVSS x exposure) instead of a single flat number. This is exactly the correlation logic Brinqa's exposure management platform runs automatically across asset, vulnerability, and threat intelligence data.
5. Build the prioritized remediation queue
Rank the combined score and cut the list at a volume your patching team can actually execute in the current sprint — usually the top 50 to 200 items, not the top 5,000. Assign owners and SLAs tied to the EPSS tier, not the raw CVSS number. Common mistake: publishing a 3,000-item "priority" list that reads identically to the unprioritized backlog it replaced.
6. Automate the score refresh
EPSS scores move daily, sometimes sharply, when new exploit code or scanning activity gets observed. A CVE sitting at 0.04 last week can jump to 0.60 this week. Schedule a nightly or weekly pull instead of a one-time export. Expected outcome: your priority queue reflects current exploitation reality, not a stale monthly snapshot.
7. Validate against CISA KEV
Cross-check your top EPSS-ranked CVEs against the CISA Known Exploited Vulnerabilities catalog. Any overlap confirms exploitation is already documented, not just probabilistically predicted — treat those as non-negotiable, immediate remediation regardless of where they land on your internal queue. Common mistake: treating EPSS and KEV as competing lists instead of confirming signals.
8. Report against EPSS-driven SLAs
Set remediation SLAs by EPSS tier (e.g., top-percentile CVEs patched within 7 days, mid-tier within 30) and report against that instead of raw finding counts. This gives leadership a metric tied to actual exploitation risk instead of an arbitrary CVSS bucket. Expected outcome: a remediation report that shows risk reduction, not just ticket closure volume.
See EPSS scoring in your own environment
Brinqa correlates EPSS, CVSS, and asset exposure automatically.
Troubleshooting
- A CVE has no EPSS score at all. New CVEs sometimes lack enough data for the model to score them yet. Treat them as unscored, not zero-risk, and re-check within a week once FIRST.org backfills the score.
- High CVSS, low EPSS score — team wants to patch anyway. That's a legitimate call for internet-facing or crown-jewel assets. EPSS predicts probability, not consequence; a 0.02 EPSS score on a payment system still deserves attention.
- Reports go stale within days. EPSS refreshes daily. If your dashboard is a quarterly export, you're prioritizing against exploitation data that's three months old.
- The team over-indexes on EPSS alone. EPSS ignores asset criticality entirely. Pair it with exposure context every time, or you'll deprioritize a low-EPSS CVE sitting on your externally exposed VPN gateway.
- Duplicate CVEs across hundreds of assets create noise. Deduplicate at the CVE level for prioritization decisions, then fan back out to per-asset remediation tickets once the queue is set.
- Leadership asks why a 9.8 CVSS CVE isn't on the top-10 list. Show the EPSS percentile alongside CVSS in every report — the gap between severity and probability is the entire point of using EPSS score in the first place.
Tools and resources
- FIRST.org EPSS API and daily CSV feed — the source of truth for current scores
- CISA Known Exploited Vulnerabilities (KEV) catalog — confirms active exploitation
- CVSS v3.1/v4 calculators — for the severity half of the pairing
- Your vulnerability scanner's CVE export — the raw inventory you're scoring against
- Brinqa for teams that want EPSS, CVSS, and asset exposure correlated automatically instead of joined by hand in a spreadsheet every week
What to do next
Once EPSS-driven prioritization is running, the next gap is usually asset context — knowing which systems are internet-facing, which sit behind segmentation, and which hold regulated data. That's the layer that turns a probability score into a real business risk ranking, and it's worth building out before your next audit cycle in 2026.
FAQ
What is an EPSS score?
An EPSS score is a number from 0 to 1 predicting the probability that a specific CVE will be exploited in the wild within the next 30 days. It's maintained by FIRST.org and updates daily based on threat intelligence and observed exploitation signals.
Is EPSS better than CVSS for prioritization?
EPSS and CVSS answer different questions, so neither replaces the other. CVSS measures potential severity if exploited; EPSS measures the probability of exploitation actually happening, and combining both gives a far sharper priority list than either alone.
How often does an EPSS score change?
EPSS scores update daily as FIRST.org's model ingests new threat and exploitation data. A CVE can move from a 0.03 to a 0.60 score within a week if exploit activity spikes, which is why static exports go stale fast.
What EPSS score threshold should I use for patching?
Most mature programs prioritize by percentile rather than a fixed score, treating the top 5-10% of EPSS-ranked CVEs as the active remediation queue. A flat cutoff like 0.1 works as a starting point but should flex with asset exposure.
Does a low EPSS score mean a vulnerability is safe to ignore?
No. A low EPSS score means exploitation is unlikely in the next 30 days, not that the vulnerability is harmless, especially on internet-facing or high-value assets. Pair the score with asset exposure before deprioritizing anything.
How is EPSS score different from CISA KEV?
EPSS is a probabilistic prediction of future exploitation; KEV is a confirmed list of vulnerabilities already exploited in the wild. Use KEV as a hard override — anything on that list gets remediated regardless of its EPSS score.
Where do I get EPSS scores for my vulnerability data?
FIRST.org publishes EPSS scores through a free API and a daily CSV feed covering every scored CVE. Vulnerability and exposure management platforms typically ingest this feed automatically and join it to your existing CVE inventory.
What is EPSS v4?
EPSS v4 is the current model version released by FIRST.org in 2025, improving prediction accuracy over earlier versions by incorporating additional threat intelligence signals. Most vulnerability management tooling in 2026 pulls scores generated by this version.
One last thing
Fewer than 5% of all published CVEs are ever exploited in the wild, based on aggregated research cited by FIRST.org — which means a CVSS-only prioritization strategy is, by definition, spending most of its effort on vulnerabilities that will never matter. Run the EPSS join once against your current backlog and watch how many "critical" tickets drop out of the top 50 the moment probability enters the equation.