EPSS (exploit prediction score)
A daily estimate, from 0% to 100%, of how likely a flaw is to be exploited in the next 30 days.
The Exploit Prediction Scoring System is run by FIRST.org, a nonprofit for security response teams. It uses data about real attacks, public exploit code and how the flaw works to estimate how likely attackers are to use it soon.
The scores are updated daily. Most flaws score under 1%. A flaw scoring 10% or more is unusually likely to be attacked.
Patch Sonar shows each flaw's EPSS score and uses it, along with ransomware use and internet exposure, to rank the "Patch these first" list.
Why it matters to you: EPSS helps you choose between two urgent updates when you can only do one today.
Related terms
- CVSS severity scoreA score from 0 to 10 for how bad a flaw could be if attacked. It measures potential damage, not whether anyone is attacking it.
- CISA's Known Exploited Vulnerabilities catalog (KEV)The U.S. government's official list of software flaws with confirmed real-world attacks, each with a deadline for federal agencies to fix it.
- Exploited vulnerabilityA software flaw that attackers are actually using in real attacks, not just one that could be used in theory.