Glossary

EPSS

Exploit Prediction Scoring System

Exploit Prediction Scoring System, from FIRST. It estimates the probability that a published CVE will be exploited in the wild in the next 30 days; combine it with exposure, impact and evidence of known exploitation.

Defined in: FIRST Exploit Prediction Scoring System

Covered in

Guide

Prioritize vulnerabilities by exploitation, exposure and impact

Rank vulnerabilities with CISA KEV, EPSS, CVSS 4.0 vectors and SSVC decision points, adjust for presence, reachability and asset value, and turn the result into due dates. Covers NVD's 2026 enrichment changes and CISA BOD 26-04.