What Is an EPSS Score?

EPSS (Exploit Prediction Scoring System) is a daily-updated score from FIRST that estimates the probability, from 0 to 1, that a published CVE will be exploited in the wild within the next 30 days. A score of 0.42 means an estimated 42% chance of observed exploitation activity in that window.

How EPSS is computed and published

EPSS is maintained by the EPSS Special Interest Group at FIRST, the organisation that also stewards CVSS. The model is trained on exploitation activity observed by security partners. It combines that data with signals about each vulnerability, such as published exploit code, its CVSS vector and weakness type (CWE), the affected vendor, its references, and whether common security scanners ship detection templates for it. Scores are recalculated every day for every published CVE. They are released as a free download and API, with a percentile that ranks each CVE against all others. The fourth version of the model was released in March 2025.

Two properties matter when you read a score. First, it describes the internet as a whole, not your environment: EPSS does not know whether you run the affected component. Second, it moves. A CVE can sit near zero for months and jump when a proof-of-concept appears, so a score only means something with its date.

How GeekWala uses EPSS

GeekWala attaches the current EPSS score to every vulnerability it finds in your dependencies. It uses that score together with CISA KEV status to order results, so the findings most likely to be exploited come first. CVSS still tells you how bad a successful exploit would be. EPSS tells you how likely one is. Reading both avoids treating every "critical" CVSS score as an emergency. Because GeekWala refreshes EPSS scores daily, the same dependency can move up or down your prioritized list between one scan and the next with no code change on your end — the risk picture shifted, not your software.

Sources: FIRST — EPSS

Related terms

• CVSS (Common Vulnerability Scoring System)
• CISA KEV (Known Exploited Vulnerabilities)
• Reachability Analysis
• VEX (Vulnerability Exploitability eXchange)

Read the full guide · What dependency vulnerability scanning is · Back to the glossary

Last updated September 13, 2026