詳細検索
↑↓移動
↵選択
ESC閉じる

What is EPSS? How to predict the probability of vulnerability exploitation and improve response efficiency

Avatar
by 菊池10/11/2025
2 min read
Tags 脆弱性管理 EPSS CVSS セキュリティ運用 脆弱性対応の優先順位 トリアージ
What is EPSS? How to predict the probability of vulnerability exploitation and improve response efficiency
Translated from 日本語 • View original
菊池
菊池

Hello! This is Kikuchi, a security analyst at Colorkrew. In recent years, the number of vulnerabilities has exploded, and it is not practical to cover them all. In situations where CVSS scores alone cannot determine priorities, EPSS (Exploit Prediction Scoring System) can be used to achieve more efficient vulnerability management.

Background: The Surge in Vulnerabilities and the Limitations of CVSS

  • In May 2024, 5,023 vulnerabilities were disclosed per month, reaching an average of approximately 170 vulnerabilities per day.
  • Due to NIST's budget cuts, the number of vulnerabilities that are awaiting analysis for CVSS scores has increased rapidly, and CVSS assessments continue to be unable to keep up.
  • CVSS is an indicator that assesses the "severity" of vulnerabilities and does not indicate the "likelihood of exploitation".

Importance of Triage

  • Of the 20,000 to 30,000 vulnerabilities reported annually, only 2 to 7% are actually exploited.
  • Organizational resources are limited and it is impossible to respond to all vulnerabilities.
  • That's why it's essential to prioritize and respond to triage .

**What is EPSS? **

EPSS (Exploit Prediction Scoring System) is an indicator that predicts the probability of vulnerability exploitation within the next 30 days.

  • Developer: FIRST (Forum of Incident Response and Security Teams)
  • Latest version: EPSS v2 (released in 2022)
  • Machine learning (XGBoost) is used to calculate scores from over 1,400 input data

EPSS Indicators

Indicator Description: EPSS ProbabilityProbability of being exploited in the next 30 days (0-1)| Percentile | Relative position in the overall (e.g., top 5%, etc.) |

Effects and Utilization of EPSS

  • EPSS can be used to efficiently identify vulnerabilities that are likely to be exploited.
  • According to simulations, CVSS alone requires the top 25.3% of vulnerabilities, but EPSS only needs to deal with the top 4.7%.

How to Look Up EPSS

How to Check on the Web

How to Get It by API (Example)

curl 'https://api.first.org/data/v1/epss?cve=CVE-2023-38408'

Ideally using CVSS and EPSS together

  • CVSS indicates "severity" and EPSS indicates "potential for exploitation".
  • By using both together, it is possible to narrow down the vulnerabilities that really need to be addressed.
  • For example, if the CVSS is high but the EPSS is low, you can decide to lower the priority of the response.
  • In addition, the determination is based on the importance of the target asset (e.g., confidential data retention).

Conclusion

  • Due to the proliferation of vulnerabilities, CVSS alone cannot keep up.
  • By leveraging EPSS, limited resources can be used efficiently and high-risk vulnerabilities can be prioritized.
  • To improve the accuracy of triage, why not consider introducing EPSS?

See more

Related Articles