EPSS
acronymgovernance & risksecurity
Stands for: Exploit Prediction Scoring System
A data-driven score estimating the odds a vulnerability gets exploited.
Exploit Prediction Scoring System estimates the probability that a given vulnerability will be exploited in the wild in the near term. It complements CVSS severity by adding a likelihood dimension to prioritization.
EPSS estimates the probability that a vulnerability will be exploited in the wild in the near term, using observed data rather than the structural characteristics CVSS scores. It exists because severity and likelihood are different questions and the industry had only been measuring one.
The practical consequence is a much smaller worklist. The overwhelming majority of vulnerabilities are never exploited, and a high CVSS score with a low EPSS probability is a different situation from one where both are high. Used well it prioritizes; used carelessly it deprioritizes something that is trivially exploitable in your specific environment, since a model of the general population knows nothing about which of your systems is exposed.
Also known as: epss