EPSS: Challenges and Opportunities Going Forward + EPSS AMA
summary
A live standard for estimating the probability a CVE is exploited in the next 30 days is now public and four years old, with scores produced for ~230,000 CVEs and a SIG of 400+ members. EPSS predicts 30‑day exploitation probability using an XGBoost model trained on ~1,400 features (top predictor: number of references), backtests predictions daily, and shows steady improvement from V1→V2→V3. Data gaps limit visibility (IDS signatures exist for ~10–20k CVEs), Kev/Metasploit coverage is tiny but high‑efficiency, and stewardship, interoperability with CVSS/vendor scores, and more telemetry remain the primary opportunities.
AI-written summary · about
chapters (13)
- 0:00EPSS introduction and evolution
- 1:30EPSS interoperability challenges
- 3:17Probabilities vs percentiles in EPSS
- 6:27Thresholds and risk categorization issues
- 9:16EPSS data sources and biases
- 12:52EPSS adoption and standardization
- 17:24Exploitation patterns insights
- 25:12Q&A on EPSS scoring
- 28:02Measuring EPSS performance
- 34:18EPSS V3 improvements
- 41:48Q&A on scoring and data
- 1:06:22Q&A on EPSS updates
- 1:22:11Closing remarks
related talks
40mHow EPSS Is Wrong and Useful at the Same Time
58mState of EPSS and What to Expect from Version 4
51mWhen it Comes to Managing Risk, Context is King
27mModeling Asset Risk Using Grouped EPSS
54mTowards Real World Cyber Risk (Panel)
32mUnderstanding Exploitability with VEX, EPSS, and Other Standard Frameworks
15mKeynote
01h 00mFIRSTCON21 - June 8 | Stream 2 Part 2 (14:30-15:30 UTC)