Glossary

Exploit Prediction Scoring System (EPSS)

What Is the Exploit Prediction Scoring System (EPSS)?

The Exploit Prediction Scoring System (EPSS) is a probabilistic score, maintained by FIRST, that estimates the likelihood a given CVE will be exploited in the wild within the next 30 days — used to prioritize vulnerabilities by predicted real-world exploitability rather than just severity.

CVSS measures how bad a vulnerability could be in theory. EPSS estimates how likely it is to be exploited in practice. Together with KEV status and reachability context, EPSS helps security teams cut through CVE volume and focus on what is actually likely to be used against them.

Vulnerabilities & RiskHarvest Now, Forge Later (HNFL)Harvest Now, Forge Later (HNFL) is an adversary strategy of collecting signatures and certificates today to forge them once quantum computing derives private keys.Read definition
Vulnerabilities & RiskCWE (Common Weakness Enumeration)A CWE (Common Weakness Enumeration) is a category of underlying software flaw — like buffer overflow or SQL injection — that can lead to vulnerabilities.Read definition
Vulnerabilities & RiskBinary HardeningBinary hardening is the set of compile-time protections — stack canaries, ASLR, DEP, PIE — that make exploiting vulnerabilities in executable software much harder.Read definition

Exploit Prediction Scoring System (EPSS)

What Is the Exploit Prediction Scoring System (EPSS)?

Related Terms

Related Content