CVSS vs. EPSS: The Battle of Vulnerability Metrics
Why Most Vulnerabilities Don’t Matter - And How to Find the Ones That Do
Imagine you’re running a medieval kingdom. You have thousands of castles, each with its own defenses, walls, and vulnerabilities. Some castles have weak gates, others have secret underground passages, and some are just sitting there, wide open, waiting to be looted.
Now, you need a way to decide which castle to fix first. Do you reinforce the biggest castles with the thickest walls, or do you focus on the ones that are actually under attack right now? This is the core dilemma of cybersecurity, and it’s where CVSS and EPSS come in.
CVSS (Common Vulnerability Scoring System) is like an architectural assessment - it tells you how structurally weak a castle is, based on objective criteria like wall thickness, gate strength, and how easily an enemy could get in if they tried.
EPSS (Exploit Prediction Scoring System) is like a spy network - it monitors enemy movements and tells you which castles are likely to be attacked next.
Both are useful, but they answer very different questions. CVSS tells you how bad a vulnerability could be. EPSS tells you how likely it is to actually be exploited. And if you’re trying to defend your kingdom (or your network), knowing both is critical.
CVSS: Measuring the “Worst-Case Scenario”
CVSS was introduced in 2005 to give cybersecurity teams a way to measure the severity of a vulnerability. It assigns a score from 0 to 10, based on a formula that considers things like:
Attack vector (Can it be exploited remotely, or does the attacker need physical access?)
Impact (Does it allow full system takeover, or just minor data exposure?)
Privileges required (Does the attacker need to be an admin, or can any random person exploit it?)
User interaction (Does the attack happen automatically, or does it require tricking someone into clicking a link?)
It’s a simple, standardized way to describe how dangerous a vulnerability can be. If a vulnerability has a CVSS score of 9.8, that’s like saying, “This is a wide-open gate with no guards - it’s a huge problem.”
The beauty of CVSS is that it’s universal. Every vulnerability gets a CVSS score, so security teams can easily sort their priorities: patch the 9s and 10s first, worry about the 5s and 6s later.
But here’s the catch: CVSS doesn’t tell you whether anyone actually cares about exploiting a given vulnerability.
Imagine you’re a medieval general, and your engineers tell you that Castle A has a huge weak spot in its wall. But your spies tell you that no army is anywhere near Castle A. Meanwhile, Castle B has a small crack in its wall, but enemy soldiers are already storming the gates.
Which one do you fix first? That’s where EPSS comes in.
EPSS: Predicting Attacks Before They Happen
EPSS is a machine learning model that looks at real-world hacker activity and estimates the probability that a vulnerability will be exploited within the next 30 days.
Instead of just ranking vulnerabilities by how severe they could be (like CVSS), EPSS uses data from real attacks, exploit kits, malware, and hacker forums to estimate which vulnerabilities attackers are actually interested in.
It assigns each vulnerability a probability score between 0 and 1 (or 0% to 100%). A vulnerability with an EPSS score of 0.8 (80%) means there’s a very high chance that someone will try to exploit it soon. A vulnerability with an EPSS score of 0.01 (1%) means that, while it exists, nobody seems to be attacking it.
Think of EPSS like an early warning system. It tells you, “Hey, attackers are actively discussing and using this vulnerability - maybe you should fix it now.”
CVSS vs. EPSS: The Key Differences
CVSS and EPSS serve different purposes, and they are not competitors—they are partners.
In simple terms:
CVSS tells you how bad a vulnerability could be. EPSS tells you whether attackers actually care about it.
A CVSS 9.8 vulnerability with an EPSS of 0.01 is like a huge hole in a castle wall - but it’s in the middle of nowhere, and no enemy is anywhere near it.
A CVSS 6.5 vulnerability with an EPSS of 0.7 is like a small crack in a wall - but enemy forces are actively exploiting it right now.
Which one should you prioritize? Most security teams today rely on EPSS to focus their efforts.
Why EPSS is a Game-Changer
Traditionally, security teams have relied heavily on CVSS.
The problem?
Most high-CVSS vulnerabilities are never actually exploited.
Studies show that 90%+ of vulnerabilities are never used by attackers - yet many security teams still waste time patching them just because they have a high CVSS score.
EPSS fixes this by showing which vulnerabilities are actually being exploited in the wild. This allows security teams to:
Patch fewer vulnerabilities, but the right ones – Instead of fixing 100 high-CVSS issues, they can focus on the 5 that attackers are actively targeting.
Respond faster – If a vulnerability’s EPSS score spikes overnight, they know something changed and can react quickly.
Reduce unnecessary work – Instead of blindly following CVSS-based policies, they can focus on the issues that truly matter.
Some organizations have cut their patching workload by 80% by using EPSS alongside CVSS.
Where CVSS and EPSS Fall Short
Neither CVSS nor EPSS is perfect. The Major limitations of CVSS are
Ignoring real-world exploitation – Just because a vulnerability has a CVSS 9.8 doesn’t mean anyone is attacking it.
Lack of accountability for business impact – It treats all systems equally, even though some are mission-critical and others don’t matter.
Scores are static – A CVSS score is set when a vulnerability is published, but threats change over time.
On the other side limitations of EPSS are
Short-term focus – EPSS only predicts attacks in the next 30 days, so it might miss long-term threats.
No impact assessment – EPSS tells you if something will be exploited, but not how bad it will be if it is.
Relies on data – If a vulnerability is new or rare, EPSS may not have enough data to make a good prediction.
This is why the best approach is to use both.
The Smart Way to Prioritize Vulnerabilities
The smartest security teams today use CVSS and EPSS together like this:
Check CVSS first – If a vulnerability is CVSS 9.0+, it might be worth investigating.
Look at EPSS – If it has an EPSS above 50%, prioritize it immediately.
Consider your environment – If the vulnerable system is mission-critical, patch it even if EPSS is low.
Monitor EPSS over time – If a vulnerability’s EPSS suddenly jumps from 0.01 to 0.5, something changed - act fast.
The Bottom Line
By combining CVSS for impact and EPSS for likelihood, you cut out the noise and focus on the threats that actually matter. This shift - from blind patching to risk-based vulnerability management - is the future of cybersecurity.
And in a world where attackers are constantly evolving, having the right intelligence can mean the difference between being prepared… or being breached.