# Exploit Prediction Scoring System (EPSS)

arXiv: https://arxiv.org/abs/1908.04856 · HTML: https://mlsanity.com/paper/1908.04856/

## Key facts

- Cited by 22 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 13 Aug 2019.

## Built on by (most cited first, 22 of 22)

- [A Survey on Data-driven Software Vulnerability Assessment and Prioritization](https://mlsanity.com/paper/2107.08364/) (2021)
- [CVSS-BERT: Explainable Natural Language Processing to Determine the Severity of a Computer Security Vulnerability from its Description](https://mlsanity.com/paper/2111.08510/) (2021)
- [Uncovering Vulnerabilities of LLM-Assisted Cyber Threat Intelligence](https://mlsanity.com/paper/2509.23573/) (2025)
- [POLAR: Automating Cyber Threat Prioritization through LLM-Powered Assessment](https://mlsanity.com/paper/2510.01552/) (2025)
- [Cream Skimming the Underground: Identifying Relevant Information Points from Online Forums](https://mlsanity.com/paper/2308.02581/) (2023)
- [AI Native Asset Intelligence](https://mlsanity.com/paper/2605.09115/) (2026)
- [Vulnerability Prioritization: An Offensive Security Approach](https://mlsanity.com/paper/2206.11182/) (2022)
- [JAF: Judge Agent Forest](https://mlsanity.com/paper/2601.22269/) (2026)
- [Automation-Exploit: A Multi-Agent LLM Framework for Adaptive Offensive Security with Digital Twin-Based Risk-Mitigated Exploitation](https://mlsanity.com/paper/2604.22427/) (2026)
- [Perspectives on risk prioritization of data center vulnerabilities using rank aggregation and multi-objective optimization](https://mlsanity.com/paper/2202.07466/) (2022)
- [OutCenTR: A novel semi-supervised framework for predicting exploits of vulnerabilities in high-dimensional datasets](https://mlsanity.com/paper/2304.10511/) (2023)
- [Vulnerability Clustering and other Machine Learning Applications of Semantic Vulnerability Embeddings](https://mlsanity.com/paper/2310.05935/) (2023)
- [HAL 9000: a Risk Manager for ITSs](https://mlsanity.com/paper/2311.09449/) (2023)
- [Scoring the Unscorables: Cyber Risk Assessment Beyond Internet Scans](https://mlsanity.com/paper/2506.06604/) (2025)
- [CyGATE: Game-Theoretic Cyber Attack-Defense Engine for Patch Strategy Optimization](https://mlsanity.com/paper/2508.00478/) (2025)
- [A Risk Manager for Intrusion Tolerant Systems: Enhancing HAL 9000 with New Scoring and Data Sources](https://mlsanity.com/paper/2508.13364/) (2025)
- [RiskBridge: Turning CVEs into Business-Aligned Patch Priorities](https://mlsanity.com/paper/2601.06201/) (2026)
- [Bridging the Gap Between Security Metrics and Key Risk Indicators: An Empirical Framework for Vulnerability Prioritization](https://mlsanity.com/paper/2603.12450/) (2026)
- [From Incomplete Architecture to Quantified Risk: Multimodal LLM-Driven Security Assessment for Cyber-Physical Systems](https://mlsanity.com/paper/2604.05674/) (2026)
- [From Legacy Documentation to OSCAL: An MCP-Based Agent Pipeline for Threat-Informed Continuous Compliance in Critical Infrastructure](https://mlsanity.com/paper/2607.08288/) (2026)
- [On Predicting Vulnerability Severity Using In-Context Learning: An Industrial Case Study](https://mlsanity.com/paper/2608.22089/) (2026)
- [Polar: LLM-Powered Synthesis of Real-World Cyber Evidence for Prioritization and Mitigation](https://mlsanity.com/paper/2610.07298/) (2026)

## Abstract (arXiv)

Despite the massive investments in information security technologies and research over the past decades, the information security industry is still immature. In particular, the prioritization of remediation efforts within vulnerability management programs predominantly relies on a mixture of subjective expert opinion, severity scores, and incomplete data. Compounding the need for prioritization is the increase in the number of vulnerabilities the average enterprise has to remediate. This paper produces the first open, data-driven framework for assessing vulnerability threat, that is, the probability that a vulnerability will be exploited in the wild within the first twelve months after public disclosure. This scoring system has been designed to be simple enough to be implemented by practitioners without specialized tools or software, yet provides accurate estimates of exploitation. Moreover, the implementation is flexible enough that it can be updated as more, and better, data becomes available. We call this system the Exploit Prediction Scoring System, EPSS.