EPSS-Perzentil
EPSS Percentile Rank
EPSS-Perzentilrang
The Exploit Prediction Scoring System (EPSS) percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this Common Vulnerabilities and Exposures (CVE) has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.
Practical context. The percentile is often used for threshold rules („escalate everything at or above the 95th percentile“) because it is independent of the absolute model scale — even when the distribution shifts over time, „top 5 %“ remains a workable phrasing. The downside: the percentile conveys no absolute urgency. A Common Vulnerabilities and Exposures (CVE) at the 99th percentile can still carry only a score of 0.08 (8 % probability) if the underlying distribution is very low overall.
Difference from the score. The score is the probability itself; the percentile is the rank position. For operational prioritisation within one's own estate the score is the more direct signal; the percentile is ideal for cross-organisational SLA rules („everything ≥ 95th percentile within 7 days“).