Full glossary

Glossary · EPSS

EPSS: the likelihood that a vulnerability will be exploited

Why a severity score isn't enough, and how EPSS helps you triage.

Updated · 3-minute read

Read with an AI .md version

In one sentence

EPSS (Exploit Prediction Scoring System) estimates, every day, the probability that a vulnerability will be exploited within the next 30 days.

Who publishes it

FIRST, the global forum of incident response teams. Scores are updated every day.

EPSS or CVSS

CVSS measures how severe a vulnerability is if it gets exploited. EPSS measures the chance that it will be. The two complement each other.

And LibWatch?

LibWatch shows the EPSS of each vulnerability in the project report and its exports. Vulnerability ranking, on the other hand, relies on the KEV catalog, then on severity.

See also

  • Glossary

    CISA KEV

    Vulnerabilities actually being exploited.

  • Glossary

    CERT-FR

    Alerts from ANSSI.

  • Glossary

    SCA

    Composition analysis.

See how likely your vulnerabilities are to be exploited.

Try it for 14 days