Glossary
EPSS
Stands forExploit Prediction Scoring System
A model estimating the probability that a vulnerability will be exploited in the near term. It complements a severity score rather than replacing it.
Also calledexploit probability
A model that produces a probability — not a severity — that a given vulnerability will be exploited within a near-term horizon, from observable characteristics of the flaw and from exploitation data.
Used correctly it is the third layer: severity says how bad, the exploited-in-the-wild catalog says whether it is happening now, and the probability says how likely it is to start. The three together produce a queue that looks very different from one sorted by severity alone.