# Technical Report -- Expected Exploitability: Predicting the Development of Functional Vulnerability Exploits

arXiv: https://arxiv.org/abs/2102.07869 · HTML: https://mlsanity.com/paper/2102.07869/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 15 Feb 2021.

## Built on by (most cited first, 7 of 7)

- [A Survey on Data-driven Software Vulnerability Assessment and Prioritization](https://mlsanity.com/paper/2107.08364/) (2021)
- [On the Uses of Large Language Models to Interpret Ambiguous Cyberattack Descriptions](https://mlsanity.com/paper/2306.14062/) (2023)
- [Exploring the Limits of Transfer Learning with Unified Model in the Cybersecurity Domain](https://mlsanity.com/paper/2302.10346/) (2023)
- [Cream Skimming the Underground: Identifying Relevant Information Points from Online Forums](https://mlsanity.com/paper/2308.02581/) (2023)
- [Vulnerability Clustering and other Machine Learning Applications of Semantic Vulnerability Embeddings](https://mlsanity.com/paper/2310.05935/) (2023)
- [Scoring the Unscorables: Cyber Risk Assessment Beyond Internet Scans](https://mlsanity.com/paper/2506.06604/) (2025)
- [HARP: Hierarchical Adaptive Ranking with Preference-Adaptive Fusion for Query-Based CVE Prioritization](https://mlsanity.com/paper/2608.19430/) (2026)

## Abstract (arXiv)

Assessing the exploitability of software vulnerabilities at the time of disclosure is difficult and error-prone, as features extracted via technical analysis by existing metrics are poor predictors for exploit development. Moreover, exploitability assessments suffer from a class bias because "not exploitable" labels could be inaccurate. To overcome these challenges, we propose a new metric, called Expected Exploitability (EE), which reflects, over time, the likelihood that functional exploits will be developed. Key to our solution is a time-varying view of exploitability, a departure from existing metrics. This allows us to learn EE using data-driven techniques from artifacts published after disclosure, such as technical write-ups and proof-of-concept exploits, for which we design novel feature sets. This view also allows us to investigate the effect of the label biases on the classifiers. We characterize the noise-generating process for exploit prediction, showing that our problem is subject to the most challenging type of label noise, and propose techniques to learn EE in the presence of noise. On a dataset of 103,137 vulnerabilities, we show that EE increases precision from 49% to 86% over existing metrics, including two state-of-the-art exploit classifiers, while its precision substantially improves over time. We also highlight the practical utility of EE for predicting imminent exploits and prioritizing critical vulnerabilities. We develop EE into an online platform which is publicly available at https://exploitability.app/.