What EPSS is
EPSS, the Exploit Prediction Scoring System, is a data-driven model that estimates the probability a given CVE will be exploited in the wild within the next thirty days. It produces a score between 0 and 1.
The model is retrained on observed exploitation activity, so the score for a CVE moves over time as evidence accumulates. A vulnerability that was quiet at disclosure can climb sharply once exploitation appears.
EPSS versus CVSS
CVSS measures severity: how much damage a successful exploit could do. It is largely static after publication. EPSS measures likelihood: how probable exploitation is right now.
These answer different questions. A CVSS 9.8 with a tiny EPSS score is theoretically dangerous but unlikely to be hit. A mid-range CVSS with a high EPSS is a present threat. Ranking by CVSS alone over-invests in the first and under-invests in the second.
Why probability matters more
The vast majority of published CVEs are never exploited. Patching strictly by severity spends effort on vulnerabilities that pose little real-world risk while higher-probability ones wait.
Combining EPSS with the CISA KEV catalogue sharpens this further. KEV is confirmed active exploitation. EPSS is predicted exploitation. Together they separate the urgent few from the noisy many.
How Secuno uses EPSS
Each correlated vulnerability risk carries its EPSS score alongside CVSS and KEV status. Secuno uses these inputs in its risk scoring so the risk list orders by real exposure, not raw severity.
Secuno keeps ninety days of EPSS history per CVE and alerts a client's administrators when a score rises past the alert threshold on a CVE they have an open risk for. A KEV listing triggers an immediate targeted correlation and escalates the affected risks. Because correlation and scoring are continuous, the priority order tracks the threat landscape rather than freezing at the moment of a scan.