#Differences
| CVSS | EPSS | |
|---|---|---|
| Measures | Characteristics and severity of a vulnerability | Probability of exploitation activity in the next 30 days [1] |
| Scale | 0–10 | 0–1 probability (plus percentile) |
| Changes over time | Base score is static | Updated daily from threat data |
| Maintained by | FIRST | FIRST (EPSS SIG); model introduced by Jacobs et al. [2] |
| Knows your environment | Only via environmental metrics you supply | No |
| Knows attack paths | No | No |
#Why both scores mislead on their own
Most published vulnerabilities are never exploited in the wild, so sorting by CVSS sends teams after many severe-sounding issues that attackers ignore. EPSS addresses that by estimating likelihood from observed exploitation activity and vulnerability features, updated daily. But EPSS is a global probability: it doesn't know whether the vulnerable service is internet-facing in your environment, whether compensating controls exist, or whether the host sits on a path to anything valuable. A 0.9 EPSS score on an isolated lab server matters less than a 0.05 score on the identity provider.
#A combined rule that works
- Anything on CISA's Known Exploited Vulnerabilities catalog and reachable: fix first.
- High EPSS and on a path to a critical asset: next.
- High CVSS but low EPSS and off-path: schedule.
- Everything else: batch.
The second criterion — "on a path" — is the one neither score provides. In our Monte Carlo study, even a perfect likelihood ranking left 76% breach probability after 10 fixes in a diffuse network, while path-aware fixing reached 15%.
#Sources
- [1] FIRST / EPSS overview (Wikipedia summary of the current model)
- [2] J. Jacobs et al., “Exploit Prediction Scoring System (EPSS),” arXiv:1908.04856
Talk to an operator.
Thirty minutes, no slides. We'll show you what bad AI finds in one of your systems.
Book a briefing