Your security scanner just flagged 847 vulnerabilities. Your team can fix 20 this sprint. Which 20?
If your answer is "the ones with the highest CVSS scores," you're using an imperfect heuristic that leaves your real attack surface exposed while you remediate vulnerabilities that will never be exploited.
The Problem with CVSS Alone
CVSS measures theoretical severity: how bad would this be if exploited? What it doesn't measure is likelihood: how probable is it that this vulnerability will actually be exploited?
Fewer than 5% of published CVEs are ever observed being exploited in the wild. A CVSS 9.8 vulnerability with no public exploit code may sit indefinitely unexploited. Meanwhile, a CVSS 6.5 vulnerability that's trivial to exploit may be actively used in attacks within days.
What EPSS Is
The Exploit Prediction Scoring System assigns each CVE a probability score between 0 and 1 representing the likelihood of exploitation within the next 30 days.
The model uses:
- Exploit availability. Public proof-of-concept code in Metasploit or ExploitDB.
- Threat intelligence feeds. References in threat actor communication, honeypot logs.
- Social media signals. Discussions by security researchers, blog posts.
- Temporal dynamics. Scores update daily with new information.
- Historical patterns. Characteristics that correlate with real-world weaponization.
How EPSS Changes Prioritization
CVE-A: CVSS 9.8. No public exploit, no threat actor interest. EPSS: 0.003 (0.3%).
CVE-B: CVSS 6.5. Public exploit last week, ransomware groups targeting it. EPSS: 0.847 (84.7%).
Pure CVSS prioritization fixes CVE-A first. EPSS correctly identifies CVE-B as urgent.
The EPSS + CVSS Framework
- High CVSS + High EPSS: Fix immediately
- High CVSS + Low EPSS: Schedule remediation
- Low CVSS + High EPSS: Prioritize above severity rating
- Low CVSS + Low EPSS: Standard backlog
EPSS Limitations
A low EPSS score reflects current intelligence, not a permanent assessment. EPSS reflects population-level risk, not organizational context. And EPSS covers published CVEs only — zero-days are outside scope.
How CodeAnt Integrates EPSS
CodeAnt AI incorporates EPSS scores directly into security scanning. Rather than presenting raw CVE lists ordered by CVSS, CodeAnt combines EPSS probability with severity and your codebase context to surface vulnerabilities representing genuine, current risk.
About CodeAnt AI
CodeAnt AI integrates threat intelligence including EPSS scoring to help teams prioritize and remediate vulnerabilities that represent real risk. Stop chasing theoretical severity — start addressing actual exposure.
Top comments (0)