The Exploit Prediction Scoring System (EPSS) gives a probability score estimating whether a vulnerability will be exploited in the wild. It helps assess likelihood, one part of risk alongside impact. section 6.3.1 section 6.3.2
Use EPSS to challenge a severity-only remediation queue. CVSS describes severity, but a high CVSS score does not necessarily mean high risk in a particular environment. Compare exploit likelihood with threat intelligence, business impact, and compensating controls before deciding what to fix first. section 6.3.2
Reading a vulnerability dashboard
A dashboard lists 15 vulnerabilities, including two with high EPSS scores. Those two warrant priority attention. Separately, its risk graph identifies a medium-CVSS vulnerability as the highest-risk, lowest-effort fix. The useful decision is not to sort by one score alone: investigate the high-EPSS findings and weigh each possible correction against overall risk and effort. section 6.5
