EPSS is not foolproof: Shift your AppSec beyond vulnerabilities

This report critiques reliance on predictive vulnerability models—especially EPSS—summarizing a Purdue study that shows EPSS often trails real-world exploitation signals compared to CISA’s KEV, and urging organizations to pair EPSS, CVSS, and KEVs with contextual risk factors (asset criticality, attack surface, business impact) within a defense-in-depth strategy. Expert commentary emphasizes prioritizing KEVs, leveraging EPSS to flag likely exploitation, and continually reassessing based on observed threats, as escalating exploit activity and vulnerability disclosures demonstrate that patching alone cannot secure modern AppSec.