# EPSS: the likelihood that a vulnerability will be exploited

Source: https://libwatch.com/en/glossary/epss

Glossary · EPSS

Why a severity score isn't enough, and how EPSS helps you triage.

Updated October 22, 2026 · 3-minute read

In one sentence

EPSS (Exploit Prediction Scoring System) estimates, every day, the probability that a vulnerability will be exploited within the next 30 days.

## Who publishes it

[FIRST](https://www.first.org/epss/), the global forum of incident response teams. Scores are updated every day.

## EPSS or CVSS

CVSS measures how severe a vulnerability is if it gets exploited. EPSS measures the chance that it will be. The two complement each other.

## And LibWatch?

LibWatch shows the EPSS of each vulnerability in the project report and its exports. [Vulnerability ranking](/en/features/prioritization), on the other hand, relies on the KEV catalog, then on severity.

## See also

- Glossary
### [CISA KEV](/en/glossary/cisa-kev)

Vulnerabilities actually being exploited.

- Glossary
### [CERT-FR](/en/glossary/cert-fr)

Alerts from ANSSI.

- Glossary
### [SCA](/en/glossary/sca)

Composition analysis.

## See how likely your vulnerabilities are to be exploited.

[Try it for 14 days](https://app.libwatch.com/users/sign_up?source=glossary_epss)