Exploit Prediction Scoring System (EPSS)

Despite the large investments in information security technologies and research over past decades, industry is still immature when it comes to vulnerability management. In particular, prioritization of remediation efforts within management programs predominantly relies on a mixture subjective expert opinion severity scores. Compounding need for increase number vulnerabilities average enterprise has remediate. This article describes first open, data-driven framework assessing threat, that is, probability will be exploited wild 12 months after public disclosure. scoring system been designed simple enough implemented by practitioners without specialized tools or software yet provides accurate estimates (ROC AUC = 0.838) exploitation. Moreover, implementation flexible can updated as more, better, data becomes available. We call this Exploit Prediction Scoring System (EPSS).