Bottom line: EPSS is a dated forecast about observed exploitation activity for a CVE over the next 30 days. It does not know whether you run the product, how a successful exploit would affect you, or whether your controls change the outcome.
\nThe official FIRST EPSS FAQ describes EPSS as a data-driven model that estimates the probability that exploitation activity associated with a publicly disclosed CVE will be observed in the wild within the next 30 days. Scores range from zero to one and are updated daily. FIRST distinguishes the probability from the percentile: probability is the model’s absolute forecast, while percentile ranks a vulnerability relative to the currently scored population.
\nFIRST explicitly states that EPSS is not a complete risk score. It does not estimate impact, know an organization’s assets, or account for its compensating controls. The FAQ also distinguishes the forward-looking EPSS estimate from CISA’s Known Exploited Vulnerabilities catalog, which records confirmed exploitation, and says direct exploitation evidence should supersede a forecast.
\nA low EPSS score is not proof that exploitation is impossible or that remediation can be ignored. A high percentile can coexist with a modest absolute probability because the score distribution is not uniform. A score changes as inputs change, so an undated dashboard value is weak evidence.
\nEPSS does not replace vendor severity, CVSS context, contractual deadlines, emergency directives, safety assessment, or environment-specific risk analysis. Combining unrelated scores through an invented formula can create a number without a defensible meaning.
\nThe following steps are DSE recommendations based on the cited source.
\nSample vulnerability decisions across high and low EPSS values. Reconstruct the dated score, applicability, direct exploitation checks, impact and exposure context, owner, remediation or acceptance decision, due date, change evidence, and reassessment. Confirm that a score change or KEV addition can update the queue.
\n