What does EPSS stand for?
EPSS stands for Exploit Prediction Scoring System. The Exploit Prediction Scoring System estimates the probability that a vulnerability will be exploited in the next 30 days. Combined with CVSS severity, it helps decide what to patch first. CompTIA's list prints it as "Exploitability Predication Scoring System".
EPSS is a model run by FIRST that estimates, for each published CVE, the probability that it will be exploited in the wild in the next 30 days. The score is a number between 0 and 1, updated daily, and comes with a percentile that shows how it ranks against all other CVEs. Teams use it to decide what to patch first: it measures the likelihood of attack, which a severity score does not.
EPSS in practice: an example
A scan lists two CVEs with a CVSS score of 9.8. One has an EPSS probability of 0.92, the other 0.002. With time to patch only one tonight, the team starts with the first, because it is far more likely to be attacked soon.
What EPSS is confused with
EPSS vs CVSS: what is the difference?
CVSS rates how bad a vulnerability would be if exploited. EPSS estimates how likely exploitation is in the near term. A flaw can be critical by CVSS and still very unlikely to be attacked. What CVSS stands for
EPSS vs KEV: what is the difference?
CISA's Known Exploited Vulnerabilities catalog lists flaws that have already been exploited. EPSS is a forecast for every CVE, including those not yet seen in attacks.
Which exams cover EPSS?
EPSS is on the official CompTIA acronym list for one of the four exams covered here.
- CySA+ CS0-004: 2.3 (Vulnerability Management).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. Two vulnerabilities have the same CVSS score. Which additional measure helps decide which is more likely to be attacked in the coming weeks?
- EPSS
- MTBF
- RPO
- SLE
Show the answer
A. EPSS. EPSS estimates the probability of exploitation in the next 30 days. The other three measure reliability, recovery and loss, not the likelihood of attack.
2. What does an EPSS score of 0.85 mean?
- The CVSS score is 8.5
- An estimated 85% probability of exploitation activity in the next 30 days
- 85% of systems are vulnerable
- The patch is 85% complete
Show the answer
B. An estimated 85% probability of exploitation activity in the next 30 days. EPSS expresses a probability from 0 to 1 for a 30-day window. It says nothing about severity or about how many systems are affected.
Sources: FIRST: Exploit Prediction Scoring System (EPSS); FIRST: EPSS frequently asked questions. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.