EPSS-Score
EPSS Exploit Probability
EPSS-Ausnutzungswahrscheinlichkeit
The Exploit Prediction Scoring System (EPSS) score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“. The score is the direct, operational number — unlike the EPSS percentile, which only describes the relative position within the catalogue.
Practical context. The score is recomputed daily — after new exploitation observations, after PoC publication, after threat data updates. A score ≥ 0.5 counts as a strong signal that real-world exploitation is likely; ≥ 0.8 is marked as „critical“ in NEOSEC Intel. The score is independent of Common Vulnerability Scoring System (CVSS): a low CVSS rating can perfectly well accompany a high Exploit Prediction Scoring System (EPSS) score if the model observes concrete exploitation patterns — mass scans or public PoCs, for instance.
Difference from the percentile. The score says „how likely“, the percentile says „where in the field“. Both are complementary: a score of 0.03 (3 % probability) sounds low but can lie at a percentile ≥ 0.7 — because the majority of all CVEs score even lower. For prioritising within one's own estate, the score is the more operational signal.