EPSS (Exploit Prediction Scoring System)
A public score estimating each day the probability that a known vulnerability will be exploited within thirty days; it complements severity measured by CVSS and the list of already exploited flaws.
Tens of thousands of vulnerabilities are published every year, and no organization can fix them all in time. The CVSS score measures their technical severity, but a flaw rated critical may never be exploited, and a medium one may be exploited massively. EPSS, developed under the aegis of FIRST, the global forum of incident response teams, and published since 2021, answers a different question: what is the probability that this vulnerability will be exploited in the next thirty days? The model, regularly retrained, combines the flaw's characteristics, the existence of public exploit code, mentions in threat sources and observations of real exploitation, and produces a daily probability for each referenced vulnerability. It works alongside two other benchmarks: CVSS for impact, and the catalog of known exploited vulnerabilities, which records past exploitation. For patch management, it lets effort focus on a small fraction of flaws that carries most of the risk. For insurance, it offers a finer measure than severity for assessing an insured's exposure from an external scan, and for deciding which unpatched vulnerabilities justify an exclusion or an underwriting condition.
Textbook case: an external scan of a prospect finds two unpatched flaws: one scored 9.8 on CVSS but with a 0.3 percent exploitation probability, the other scored 7.5 but at 94 percent and listed in the known exploited catalog. The underwriter makes cover conditional on fixing the second.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.