← All Terms

Exploit Prediction Scoring System

EPSS

FIRST's data-driven estimate of the probability that a published CVE will be exploited in the wild in the next 30 days.

Governance & Risk

The Exploit Prediction Scoring System is a machine-learning model, run by FIRST, that gives each published CVE a probability of being exploited in the wild within the next 30 days. Scores are refreshed daily from threat intelligence, exploit code and other signals.

It answers a different question from CVSS. CVSS says how bad a flaw would be if used; EPSS says how likely it is to be used soon. Combining the two lets a team skip the many severe flaws that attackers ignore and focus on the smaller set they are working on.

EPSS only covers flaws with a CVE. Many AI agent findings, such as a prompt injection path through one agent’s email connector, are properties of a deployment and never get one, so they need a separate judgement of exploitability from red team and testing results.

Read more on this
Security

Agent-Aware Vulnerability Management Ranks Flaws by What the Agent Can Do

A vulnerability score describes a flaw. It says nothing about the AI agent standing behind it: how freely it acts, what it is allowed to touch, which tools it can call, what it remembers and which business process it runs. Agent-aware vulnerability management adds those five things to exploitability before deciding what to fix first. ISO/IEC 27090:2026, published in October, gives the threat side of the same picture. Here is how the two fit together and how to run it.