# The Math of Remediation: Advanced Guide to EPSS

> We do not need more alerts. We need better math. Why 95% of your backlog is noise, and how to find the 5% signal.

Canonical page: https://www.precursorintelligence.com/blog/math-of-remediation-epss-guide

Guide · 6 January 2026 · Precursor Team (Security data science) · 5 min read · Topic: Prioritisation

## In short

EPSS estimates the probability that a vulnerability will be exploited in the next 30 days. This guide explains why that matters when your backlog far outstrips your capacity, how the model is built and which signals drive it, what counts as a high score, and how to automate EPSS checks with a short Python script.

## On this page

- Why another score?
- CVSS versus EPSS
- A brief history
- How EPSS is calculated
- What is a high score?
- Using EPSS in a pipeline
- Can EPSS replace CVSS?

---

The **Exploit Prediction Scoring System (EPSS)** is a data-driven standard that estimates the probability (0-100%) that a vulnerability will be exploited in the wild within the next 30 days. Unlike CVSS, which measures severity, EPSS measures threat, allowing security teams to prioritize patches based on actual risk rather than theoretical impact.

## Why do we need another score?

Security teams face a mathematical impossibility. The average enterprise backlog contains over 14,000 vulnerabilities. Even fully staffed engineering teams can only remediate 5-10% of their backlog meaningfully.

For the last decade, the industry relied on the [Common Vulnerability Scoring System (CVSS)](https://www.precursorintelligence.com/blog/epss-vs-cvss-guide) to prioritize work. Ideally, teams would fix everything rated "Critical" (CVSS 9.0+). In practice, this approach fails because severity does not equal risk. A vulnerability can be theoretically catastrophic but mathematically irrelevant if no exploit code exists.

## What is the difference between CVSS and EPSS?

CVSS answers the question: _"How bad could this be?"_ EPSS answers the question: _"Will we actually get hit?"_

Most [holistic threat management](https://www.precursorintelligence.com/blog/finite-guide-to-threat-vulnerability-management) programs fail because they conflate these two questions. They treat potential impact as immediate danger.

| Feature | CVSS (The Potential) | EPSS (The Prediction) | CISA KEV (The Proof) |
| --- | --- | --- | --- |
| Primary Question | "If exploited, how much damage?" | "What is the probability?" | "Is it happening right now?" |
| Data Source | Static Code Analysis | Dynamic Threat Intelligence | Confirmed Forensic Evidence |
| Update Frequency | Static (Rarely changes) | Daily (Real-time) | Ad-hoc (Upon discovery) |

## A Brief History of Prediction

We cannot fix what we cannot predict. The EPSS effort began in 2019 at Black Hat, where researchers questioned the industry's obsession with _severity_ over _utility_.

- 2019: **The Hypothesis:** Jay Jacobs and team present "The Exploit Prediction Scoring System" at Black Hat USA. They propose that exploitability is learned behavior, not a static property.
- 2021: **EPSS v1 (The Launch):** First public release. It used a logistic regression model. Good, but conservative.
- 2023: **EPSS v3 (The Leap):** Shifted to an XGBoost model. Data coverage exploded. Reliability crossed the threshold for enterprise automation.

## How is EPSS calculated?

The Forum of Incident Response and Security Teams (FIRST) maintains the EPSS model. It processes variables daily to generate a probability score for every published [CVE](https://www.precursorintelligence.com/cve-search).

### Deep Dive: Inside the Black Box (EPSS v4)

While the exact algorithm (an XGBoost classifier) processes 1,466 input features, the most important signals fall into three buckets.

1. **1. Exploit Code Maturity (The "Gun")** The best predictor is the existence of tools. • **Proof-of-Concept:** Python script crashes server? Score ticks up (+0.05). • **Weaponized:** Added to Metasploit? Score jumps significantly (>0.60). • **Automated:** Wrapped into a botnet? Score hits ceiling (>0.90).
2. **2. Vector & Complexity (The "Path")** EPSS ingests the CVSS vector but interprets it differently. Remote bugs are widely more valuable to [Threat Actors](https://www.precursorintelligence.com/threat-actors) than Local ones. Attackers prefer "unauthenticated" exploits.
3. **3. Social Signal (The "Chatter")** EPSS monitors security twitter and dark web forums. The "Hype" Effect matters because hackers prioritize what everyone is talking about.

> **Key Takeaway:** EPSS is not looking for _vulnerability_; it is looking for _capability_ and _intent_.

### Understanding the "Hockey Stick" distribution

Diagram: Vulnerability Exploitation Probability: Noise (under 1% chance) 95%, Elevated (1-10%) 4%, Critical (over 10%) 1%.

The distribution of EPSS scores is heavily skewed. Most vulnerabilities (over 95%) have an EPSS score below 0.1%. By filtering out this "noise," teams can focus on the 5% that matter.

## What is a "High" EPSS score?

An EPSS score of **0.1 (10%)** is not low; it is extremely high. Use these thresholds:

- **EPSS > 10% (0.1):** Emergency. Fix immediately. (96th percentile danger)
- **EPSS > 1% (0.01):** Priority. Schedule for next sprint.
- **EPSS < 1% (<0.01):** Backlog. Monitor.

## How do I operationalize EPSS in my pipeline?

You require a triage logic we call the **Risk Triangle**.

Diagram: Risk Triangle: All Vulnerabilities pass a filter of CVSS above 7 and EPSS above 0.05 to become High Probability Risk. With internal context they go to Backlog Monitor; with external context they are a Critical Exposure, to Remediate within 7 days.

### Script: Automating EPSS Checks

Because EPSS updates daily, you should not hardcode scores. Use the FIRST.org API to check your key CVEs dynamically. Here is a production-ready Python snippet to query the score for a specific CVE.

`check_epss.py`

```python
import requests
import json

def get_epss_score(cve_id):
    """
    Fetch EPSS score from FIRST.org API.
    A score > 10% (0.1) is considered CRITICAL.
    """
    url = f"https://api.first.org/data/v1/epss?cve={cve_id}"

    try:
        response = requests.get(url, timeout=5)
        response.raise_for_status()
        data = response.json()

        if data['data']:
            score = float(data['data'][0]['epss'])
            percentile = float(data['data'][0]['percentile'])
            return score, percentile
        return 0.0, 0.0

    except Exception as e:
        print(f"Error fetching EPSS: {e}")
        return None

# Check Log4Shell (CVE-2021-44228)
cve = "CVE-2021-44228"
score, percentile = get_epss_score(cve)

print(f"[{cve}]")
print(f"Probability: {score * 100:.2f}%")
print(f"Percentile:  {percentile * 100:.2f}th")

if score > 0.1:
    print("ACTION: REMEDIATE IMMEDIATELY")
```

## Can EPSS replace CVSS?

No. They measure different things. Removing CVSS would leave you blind to impact. If a low-probability vulnerability _does_ get exploited, and it allows full database access (High CVSS), you need to know that.

The modern standard is CVSS + EPSS. One defines the bomb size; the other defines the likelihood of the fuse being lit.

---

## Related guides

- [Stop Chasing "Ghost Bugs": The Definitive Guide to EPSS vs. CVSS](https://www.precursorintelligence.com/blog/epss-vs-cvss-guide): A side-by-side guide to severity and exploit likelihood, with patching thresholds and a four-phase adoption plan.
- [Beyond EPSS: Why "Likelihood of Exploit" is the Future of Prioritization](https://www.precursorintelligence.com/blog/beyond-epss-likelihood-of-exploit): Why exploit likelihood, not severity, should set your patching order, and how to combine it with known-exploited lists and threat intelligence.
- [The Finite Guide to Threat & Vulnerability Management](https://www.precursorintelligence.com/blog/finite-guide-to-threat-vulnerability-management): The whole lifecycle, from finding your assets to proving that risk is going down, in one practical guide.

## About Precursor Intelligence

Precursor Intelligence, from Precursor Security, gives every published flaw a risk score from 0 to 100, led by evidence it is being exploited, and shows you the flaws in the software you use, riskiest first. Free to start, no card needed.

- All guides: https://www.precursorintelligence.com/blog
- Start free: https://www.precursorintelligence.com/register
- Book a demo: https://www.precursorintelligence.com/contact