EPSS and vulnerability management: New scoring system shows promise

A research review by Cyentia Institute and FIRST finds that EPSS more effectively prioritizes vulnerabilities likely to be exploited than CVSS severity alone and is complementary to CISA’s KEV. Key insights include that exploitation often targets older CVEs, many exploits occur soon after disclosure (notably within the first month to year), and exploitation intensity/duration varies widely across vulnerabilities. The report recommends using EPSS in conjunction with CVSS, KEV, and environmental context to optimize remediation, while noting EPSS is data-dependent and not infallible.