What is EPSS and how is it different from CVSS?
Short answer
EPSS (Exploit Prediction Scoring System), maintained by FIRST, estimates the probability that a vulnerability will be exploited in the wild in the next 30 days. CVSS describes how bad a flaw could be; EPSS estimates how likely it is to be used, which helps prioritize long patch lists.
The details
EPSS scores are updated daily, so a flaw’s score can rise quickly when exploit code appears.
Terms explained
Sources
Related questions
Related Guides
GuideSOC
9 Quick-Win AI Agent Use Cases for Security Operations
Nine high-impact, low-effort SOC tasks to hand to AI agents first, what each agent does and the metric that proves it, plus the tasks to keep human.
Read more GuideSOC
6 SOC Functions to Automate With AI Agents (and What to Keep Human)
Which SOC tasks should AI agents handle and which need a human? A function-by-function guide to automation potential, the AI role, the human role and the outcome.
Read more GuideSOC
How I Investigate a Suspicious PowerShell Alert in a SOC Lab
A walkthrough of the exact triage workflow, event correlation steps, and command-line decoding techniques used to analyze suspicious PowerShell execution.
Read more GuideSOC
How to Build an Agentic SOC: A 4-Phase Roadmap for AI Security Operations
A practical roadmap for moving a SOC to AI agents: build the data foundation, start with quick wins, customize and orchestrate agents, and keep humans in command.
Read more