Using the EPSS Scoring System for Better Security

What Is EPSS?

The Exploit Prediction Scoring System (EPSS) is an innovative approach to predict the likelihood of a given vulnerability being exploited in the wild. Unlike traditional methods, EPSS employs a data-driven, probabilistic model that estimates the risk of exploitation within a 30-day period. This system uses a combination of vulnerability characteristics and real-world data to provide a dynamic score, offering a more nuanced and responsive measure than static vulnerability assessments. 

EPSS scores are presented as a percentage, ranging from 0% (indicating minimal likelihood of exploitation) to 100% (signifying maximum probability of exploitation). To enhance understanding, EPSS also includes percentile rankings. These rankings place an individual EPSS score in the context of all other EPSS scores, offering a comparative perspective. This dual approach of using both probability scores and percentile rankings aids in refining the prioritization process, allowing for more informed decision-making in vulnerability management. 

EPSS enables organizations to prioritize their security efforts based on the probability of actual exploitation rather than theoretical severity.

EPSS History and Data Model

The development of the EPSS model is rooted in addressing the limitations of existing vulnerability scoring systems. Recognizing the need for a more predictive and dynamic approach, EPSS was designed to anticipate real-world exploitability rather than just assess theoretical risk. It leverages extensive data, including vulnerability attributes and historical exploitation trends, to train a machine-learning model. This model correlates various factors to predict exploitation likelihood, continually refining its accuracy with new data. The EPSS model represents a significant shift in cybersecurity risk assessment, focusing on predictive analytics to guide proactive defense strategies.

The EPSS, overseen by the Forum of Incident Response and Security Teams (FIRST) and supported by various public and private entities, assigns a score to each new CVE, indicating the likelihood of exploitation within the next 30 days. EPSS uses over 1,000 variables in its training data, including including the CVE List, exploit code repositories, security scanners, CVSS v3 base scores from the National Vulnerability Database (NVD).

EPSS vs Common Vulnerability Scoring System (CVSS)

EPSS and the Common Vulnerability Scoring System (CVSS) are distinct in assessing vulnerabilities. CVSS provides a numerical score reflecting the severity of a vulnerability based on metrics like impact and exploitability. However, it doesn't predict the likelihood of a vulnerability being exploited. In contrast, EPSS focuses on predicting exploitability, offering a dynamic, data-driven analysis. While CVSS scores indicate potential impact, EPSS scores provide insight into the probability of actual exploitation, guiding more effective prioritization of security resources. This comparison highlights the complementary nature of these systems in a comprehensive cybersecurity strategy. For more information on CVSS, you can visit the FIRST CVSS website.

CVSS assigns severity scores in the range of 0 (lowest) to 10 (highest), the Severity buckets are assigned as follows:

_{None: 0}

_{Low: 0.1 - 3.9}

_{Medium: 4.0 - 6.9}

_{High: 7.0 - 8.9}

_{Critical: 9.0 - 10.0}

EPSS vs Vulnerability Exploitability eXchange (VEX)

EPSS and Vulnerability Exploitability eXchange (VEX) serve different functions in cybersecurity. VEX provides information about the applicability of vulnerabilities in specific products or environments, helping organizations understand whether a known vulnerability is relevant to their systems. EPSS, conversely, predicts the likelihood of a vulnerability being exploited regardless of specific environments. While VEX offers context-specific applicability, EPSS gives a broader, probability-based perspective on vulnerability risks. This distinction is crucial for organizations balancing environment-specific assessments with general risk predictions. For more information on VEX, you can visit the official VEX website.

How to Use EPSS Scores

Using EPSS scores effectively involves integrating them into your vulnerability management process. These scores should guide prioritization by highlighting the vulnerabilities most likely to be exploited. Security teams can focus on these high-probability risks for patching and mitigation strategies. Additionally, EPSS scores can be used with other assessment tools like CVSS to gain a comprehensive view of the severity and exploitability of vulnerabilities. This approach enables a more targeted and efficient allocation of resources towards the most pressing security threats.

Aptori automatically incorporates real-time EPSS scores for every identified vulnerability when utilizing an integrated scanner for software composition analysis (SCA), Dependency Checks, Container Scanning, and static application security testing (SAST). This integration simplifies the process of sorting and filtering issues based on their EPSS scores, allowing for quick prioritization of critical vulnerabilities that require immediate remediation.