EPSS estimates the probability that a published CVE will be exploited in the wild during the next 30 days. It helps rank large populations, but it does not know your assets, controls or business impact.
Probability and percentile differ
Probability is the model estimate for the CVE. Percentile shows its relative position among other scored vulnerabilities. Use the probability for interpretation and the percentile for population context.
Movement can be the early signal
A rapid increase may reflect new exploit evidence or model features before confirmed exploitation appears in KEV. Compare current and previous values rather than relying only on a static cut-off.
Thresholds need a response rule
Define what happens when a CVE crosses 1%, 5%, 10% or another locally chosen threshold. Investigation should confirm presence and exposure before creating remediation work.
Practical next steps
- Ingest and retain the daily EPSS history.
- Watch both absolute probability and change.
- Combine EPSS with exposure and consequence.
- Review high-EPSS non-KEV vulnerabilities as an early-warning list.