How EPSS Is Wrong and Useful at the Same Time
summary
EPSS outputs a daily probability (0–100%) that a CVE sees observed exploitation in the next 30 days, trained on a matrix of roughly 2,800 features and ~110 million labeled rows, using XGBoost decision trees and heavy signals like Metasploit presence. The dataset spans ~360k published CVEs, about 8,000 vulnerabilities with activity in any rolling 30‑day window, and ~17k CVEs score >10%. V5 just ships with improved calibration; scores beat CVSS for coverage versus effort but remain limited by incomplete exploitation labels.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 3:13What is EPSS
- 7:09Criticisms of EPSS
- 10:59Incomplete exploitation data
- 13:50EPSS probability distribution
- 18:07Modeling essential despite data gaps
- 20:13EPSS calibration challenges
- 24:37EPSS machine learning decisions
- 30:15EPSS performance vs alternatives
- 37:17EPSS future improvements
- 38:42Q&A
related talks
01h 23mEPSS: Challenges and Opportunities Going Forward + EPSS AMA
58mState of EPSS and What to Expect from Version 4
27mModeling Asset Risk Using Grouped EPSS
51mWhen it Comes to Managing Risk, Context is King
58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization Standards
54mTowards Real World Cyber Risk (Panel)
57mSeeing the Vulnerable Forest Through the Exploited Trees
32mUnderstanding Exploitability with VEX, EPSS, and Other Standard Frameworks