> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/vulnerability-classification/epss.md). # EPSS EPSS (Exploit Prediction Scoring System) is a system that **predicts the likelihood that a given software vulnerability will be exploited in the real world**. * Unlike **CVSS**, which measures **severity**, EPSS measures **actual exploit probability**. * It helps organizations prioritize vulnerabilities **based on real-world risk**, not just theoretical impact. *** #### **Purpose of EPSS** 1. **Prioritize patching**: Focus on vulnerabilities most likely to be exploited. 2. **Reduce risk efficiently**: Avoid wasting effort on unlikely-to-be-exploited issues. 3. **Support risk-based vulnerability management**: Combine severity (CVSS) with probability (EPSS) for smarter decisions. *** #### **How EPSS Works** * Uses **machine learning models** trained on historical vulnerability data. * Inputs include: * CVSS metrics (severity) * Vulnerability age * Exploit availability (e.g., proof-of-concept or public exploit code) * Other factors, like the popularity of the affected software * Outputs a **probability score** (0–1) representing the chance the vulnerability will be exploited. *** #### **Example** | Vulnerability | CVSS Score | EPSS Score | Interpretation | | -------------------------- | -------------- | ---------- | -------------------------------- | | SQL Injection in a web app | 9.8 (Critical) | 0.85 | Very likely to be exploited soon | | Minor info disclosure | 5.0 (Medium) | 0.02 | Unlikely to be exploited | * Even if CVSS is high, EPSS might be low if the vulnerability is hard to exploit. * Conversely, a moderate CVSS vulnerability with a high EPSS might need urgent attention. *** #### **Reference** *