CVSS vs EPSS for remediation priority

CVSS vs EPSS: which score should set your remediation order?

If your scans or penetration tests have produced a long findings list and your team can only fix so many items per cycle, the question is which score sets the order. CVSS ranks severity relative to other vulnerabilities, while EPSS estimates the probability that a published CVE will be exploited in the wild in the next 30 days. The two answer different questions, so neither replaces the other. Most teams need both: CVSS to describe how bad a flaw would be if it were abused, and EPSS to judge how likely it is to be abused soon. The CVSS v4.0 specification also says Base scores should be enriched with Threat and Environmental values, which it calls highly recommended but not required, and it places regulatory requirements and breach losses outside its scope. Those are the inputs your organization has to supply.

Lead with CVSS when the decision is about impact and blast radius, such as a remote code execution flaw on an internet-facing system holding regulated data, or when you are writing a policy that must justify severity to an assessor. Lead with EPSS when the list is long and capacity is fixed, because a critical CVSS score with a very low EPSS probability may reasonably wait behind a medium-severity flaw with a high one. EPSS publishes a score and percentile for every CVE each day, and FIRST makes the data available as CSV files, an API and a GitHub repository, so you can refresh the ordering on a schedule. Confirm with your scanner vendor how it maps EPSS into its own risk fields before you rely on them.

A simple combined rule is a sensible default for a remediation SLA. For example (illustrative only): assets exposed to the internet or holding sensitive data get the shortest deadline when CVSS is high or critical, and any CVE with a high EPSS percentile moves up one tier regardless of CVSS. Record the rule, the EPSS snapshot date and any environmental adjustments in the report, as PCI SSC's penetration testing guidance expects severity rankings to be traceable. Ask your testers or scanner provider to state which CVSS version they use, since v3.1 and v4.0 scores are not directly interchangeable, and confirm whether the tool updates EPSS daily or only at scan time.

How CVSS v4.0 and EPSS differ on the factors that matter to buyers

This table compares what CVSS v4.0 and EPSS measure, how often they update, what they need as inputs, and how each score shows up in a penetration test report. Read it to decide which score answers which question in your remediation process, and what your team must supply to use each one well.

Factor	CVSS v4.0	EPSS
What it measures	Severity of a vulnerability relative to other vulnerabilities, based on its technical characteristics	Estimated probability that a published CVE will be exploited in the wild
Output	A numerical severity score	A score from 0 to 1 plus a percentile for every CVE
Time horizon	No time horizon; it describes intrinsic and contextual severity	Exploitation within the next 30 days
Update frequency	Changes when the vulnerability's base characteristics or enrichment values change	Published every day for every CVE
Free access	Specification is public; scoring is done by your team or the tool that produces the score	Free CSV files, an API and a GitHub repository published by FIRST
Enrichment	Threat and Environmental values are recommended, not required, for more meaningful results	Not enriched by your environment; it is a population-level estimate
Out of scope	Regulatory requirements and breach losses sit outside CVSS scope	Does not measure impact on your systems or data
How it appears in a pentest report	Typically cited as the severity score, with any environmental adjustment explained	Cited as likelihood context beside the severity score, with the data date noted
What your team must supply	Someone who scores Base metrics consistently and records Threat and Environmental values with reasoning	A process to pull daily data and decide how probability and severity combine in your SLA

What a CVSS score finds and misses, and what an EPSS score finds and misses

Each approach answers a different question about a vulnerability. CVSS describes how bad exploitation could be, EPSS estimates how likely exploitation is in the next 30 days, and neither knows what the affected asset is worth to your organization. The cards below show what each approach finds, what it misses, and when it is the right basis for a decision.

CVSS alone

CVSS gives a numerical severity relative to other vulnerabilities, based on the technical characteristics of the flaw. It finds severity and impact well, so it suits teams whose first question is how much damage a flaw could cause if someone used it. It misses whether attackers are active against that flaw today. A critical base score on a vulnerability nobody is exploiting can sit ahead of a moderate one that is being used in attacks. Check whether your scanner or pentest report uses the Base score alone, and whether Threat and Environmental values have been added.

EPSS alone

EPSS estimates the probability that a published CVE will be exploited in the wild within 30 days, and it updates its scores daily. It finds likelihood well, so it suits teams with large backlogs that need to see which flaws attackers are most likely to use next. It misses impact entirely. A flaw with a high probability on a non-sensitive internal host may matter less than a lower-probability flaw on a payment system. Use EPSS to order work within a severity band, and confirm which CVEs in your estate have no EPSS entry before relying on it.

Combined view

Using CVSS and EPSS together means a finding rises when it is both severe and likely to be exploited. This suits organizations with a vulnerability management program that must justify remediation order to auditors, system owners or a regulator. It still misses context outside both scores. Neither score knows whether the component is internet-facing, whether a compensating control blocks the attack path, or whether the data behind it is regulated. Record how each score was used in the prioritization decision so a later reviewer can trace the reasoning, as PCI SSC guidance expects for adjusted rankings.

Neither score: asset value and exposure

Some teams rank findings by asset value and exposure instead of scores, for example by how critical a system is to operations, what data it holds and whether it can be reached from outside the network. This suits environments with few assets, a clear asset inventory and a small team that can review each high-value system directly. It misses the external signal of active exploitation that both scores provide, so it can leave a known-exploited flaw on a low-value system open for too long. Confirm that the asset register is current before relying on it, and consider adding exploitation data once the inventory is trusted.

Why a critical CVSS score with a tiny EPSS probability may wait

A critical base severity says the flaw would do serious damage if an attacker used it. A very low EPSS probability says few attackers are likely to use it in the next 30 days. Both statements can be true at once, and the remediation decision turns on which one describes your exposure. CVSS measures the technical impact of the flaw in a generic setting, and the CVSS v4.0 specification notes that regulatory requirements and breach losses sit outside its scope. EPSS measures the likelihood of exploitation in the wild. Neither score knows whether the affected host is reachable from the internet or whether it holds regulated data, so the environment has to be added by your team and recorded. Waiting is defensible when the asset is isolated, cannot be reached from untrusted networks, and compensating controls are in place and verified by testing rather than assumed. Confirm the network path from the vulnerable component to any untrusted source, confirm that the attack vector in the CVSS vector string really requires access you have already removed, and check that the compensating control blocks the specific technique, not just the port. Waiting is not defensible when the system is internet-facing, when public or well-known exploit tooling exists for the flaw, when the system processes regulated data, or when the vulnerability sits on an identity or administrative path that an attacker could use to reach other assets. Any deferral needs traceable reasoning written into the finding record. PCI SSC's Penetration Testing Guidance expects a report to explain how severity or risk rankings were derived, typically from industry scores such as CVSS, and to show the reasoning when a score is adjusted for the environment. Record the base score and version, the EPSS value and the date it was taken, the environmental factors you applied, the compensating controls and how you verified them, the named risk owner, and a review date. Auditors and assessors will ask for this chain of reasoning, so a deferral without it is hard to defend even when the decision was sound.

How to write a combined rule for a remediation SLA

This sequence turns CVSS severity and EPSS exploitation probability into one documented remediation rule that a risk owner can approve, audit and review on a fixed schedule. It works because each step produces an input or decision the next step depends on.

Fix the CVSS version your reports use
Decide which CVSS version your vulnerability management policy, penetration test reports and scanner exports use, and record it in the policy. Confirm with your scanner and testing vendors which version each tool emits, because mixed versions in one queue make scores hard to compare. The step is done when the policy names one version and every feed that enters the queue is mapped to it.
Enrich base scores with environmental context
CVSS v4.0 treats Base metrics as the starting point and recommends adding Threat and Environmental values for more meaningful results, while noting that regulatory requirements and breach losses sit outside CVSS. Have the asset owner and security team record the business context for each asset, such as data sensitivity and whether the system is internet-facing. The output is a documented score per finding with the reasoning for each adjustment kept alongside it.
Pull EPSS scores on a fixed snapshot date
Download the EPSS score and percentile for every CVE in the queue from FIRST's free CSV files or API, using one snapshot date for the whole ranking cycle. EPSS publishes daily, so scores for the same CVE change over time and a shared snapshot keeps decisions comparable. The step is complete when each finding carries a CVSS score, an EPSS score, an EPSS percentile and the snapshot date in the ticket.
Set tiers that raise priority on exposed assets
Define remediation tiers so that a high CVSS score, a high EPSS score or both move a finding up, and so that exposure to the internet or to sensitive data moves it up further. Write the tier boundaries as explicit rules in the policy. Illustrative only: a team might place any finding with an EPSS percentile in the top band on an internet-facing asset into the fastest tier, but the actual cut-off values must be set with your risk owner. The check is a rule table that a second reviewer can apply to a sample of findings and reach the same tier.
Define the exception path for low-probability critical findings
Some critical CVSS findings will have very low EPSS probability and may wait for a later window. Document who can approve that deferral, what compensating controls must be in place, what evidence the ticket must hold, and when the finding is re-scored. Confirm with your compliance lead whether any framework you are assessed against requires specific handling for critical findings. The output is a signed exception record for each deferred finding, not a silent downgrade.
Review thresholds on a fixed schedule
Schedule a recurring review of tier boundaries, exposure definitions and exception volumes with the risk owner, and set the review interval in the policy. Compare how many findings each tier received, how many exceptions were approved and whether any deferred finding was later exploited, using KEV or threat intelligence as a cross-check. The step is done when the review minutes record any threshold change, the reason for it and the new effective date.

What you should receive from a scored test report

This table compares what a scan-based review and a penetration test should hand back when findings are scored with CVSS and EPSS, and what the buyer must supply to make those scores meaningful. Read each row as a checklist to request in the scope, since a report missing these elements leaves the remediation ranking unexplained. The main takeaway is that EPSS scores are only as current as their snapshot date, and CVSS environmental values depend on asset context only the buyer holds.

Deliverable	Scan-based review	Penetration test	What the buyer must supply
CVSS version and vector	Base score with the full vector string and the stated CVSS version for each finding	Base score with vector string, plus the reasoning behind each metric where exploitation required manual judgment	Confirmation of which CVSS version your policy requires so the report matches it
Threat and Environmental adjustments	Threat and Environmental values where the tool can source them, often left at defaults	Adjusted values with a written reason for each change, such as a compensating control observed during testing	Asset criticality, data sensitivity and existing compensating controls for each in-scope system
EPSS score and percentile	EPSS probability (0 to 1) and percentile, with the date the data was pulled	Same fields, with the snapshot date stated and re-pulled before final delivery	A rule for when EPSS is refreshed and who owns re-prioritization between test and retest
Combined priority tier	Tier per finding based on the agreed rule, such as CVSS band plus EPSS threshold	Tier per finding with the rule cited and any manual override marked	Written remediation SLA tiers from your policy, so the tiers map to your own deadlines
Downgrade or acceptance reasoning	Listed only where a tool suppressed or accepted a finding, with the basis stated	Each downgrade or risk acceptance tied to evidence, such as a control tested and a retest result	Named risk owner who can accept residual risk and the approval path for acceptances
Asset context and exposure notes	Asset list as scanned, often without business owner or internet exposure flags	Exposure notes per target, including whether the path was internet-facing or internal	Asset inventory with business owner, data classification and confirmed internet exposure
Verification of the score	Tool version and scan configuration recorded so results can be reproduced	Tester narrative showing the exploit path, which supports the stated severity	Access to a test environment or authenticated accounts so the tester can confirm the stated impact

What drives the cost and effort of applying both scores

Using CVSS and EPSS together costs staff time more than license money, because both scores are free to obtain. The effort grows with the number of findings, the quality of asset and exposure data, and how much environmental context each finding needs before a tier can be assigned.

Findings and assets in scope

Effort scales with the number of findings and the number of assets they touch. Every finding needs a base score, an EPSS lookup and a tier decision, so a scan that returns thousands of rows costs far more triage time than a focused penetration test with a dozen. Ask your testers and scanner vendor how findings are grouped per asset, and whether duplicates are merged before scoring. Illustrative example: one library flaw across 300 hosts is one decision, not 300 separate ones, if the team groups it correctly.

Asset inventory and exposure data

Environmental scoring depends on knowing which assets are internet facing, which hold regulated data and which sit behind compensating controls. When the inventory is incomplete, analysts either guess or leave the fields blank, and both outcomes distort the ranking. Before you design the rule, confirm that your asset register records owner, data classification and network exposure for each system in scope.

Environmental factors documented per finding

CVSS v4.0 says Threat and Environmental values are not required but are highly recommended for more meaningful results. Each environmental value you choose to document is a judgment that an auditor or a penetration test report reader may later ask you to justify. Decide which factors are mandatory for every finding and which are optional, because the more factors required, the more review time each finding consumes.

Manual or automated EPSS retrieval

FIRST publishes EPSS scores for every CVE every day as CSV files, an API and a GitHub repository. Pulling these into your scanner export or ticketing system is a one-time integration cost, after which the join runs without staff effort. A manual lookup for each finding is cheap at first and becomes the largest recurring cost as volume grows. Confirm which format your tooling can ingest and who owns the job if it fails.

Threshold review cadence

The rule that maps CVSS and EPSS to remediation deadlines is designed once, but it needs periodic review as the threat landscape and your asset mix change. Agree in advance how often thresholds are revisited, who approves changes, and how a change applies to open findings. Without this, SLAs drift and auditors see tiers that no longer match written policy.

Who pays for what

Internal staff pay for the rule design, the data joins, the triage and the periodic tier review. Outside testers are paid to produce scored findings in their reports, so ask them to state which CVSS version they used and how any environmental adjustments were derived. Scanner and ticketing licenses are separate costs. Request quotes that itemize rule design, integration, and recurring triage support as separate lines.

Which score to lead with by team situation

A small team with few people to patch has to decide what not to fix this sprint. In this situation EPSS usually leads the queue, because its daily probability of exploitation in the next 30 days tells you where attacker interest is most likely to land. CVSS still matters, but it works best as a tiebreaker that describes how bad a flaw would be if it were exploited. Keep the rule simple enough that one person can apply it without a spreadsheet.

Lead score: EPSS ranks the backlog, and CVSS v4.0 base severity sets the floor for anything that must be fixed regardless of probability.
Simple combined rule: Patch within a short internal window when the CVE is high on EPSS or appears in the CISA KEV catalog. Schedule the rest by CVSS severity within a longer window.
Review cadence: EPSS is published daily, so check scores on a fixed schedule instead of trying to track every change.
Exception handling: Record every item deferred on a low EPSS score, along with the owner and the date it will be reviewed again.
Tooling: Pull EPSS data from the FIRST CSV files or API into a script that flags the top of the queue, so the process does not depend on manual lookups.

Before you adopt this rule, confirm with your scanner vendor whether it can import EPSS and KEV data and whether your remediation window policy allows two tiers.

Questions buyers ask before hiring help with vulnerability scoring

Is CVSS or EPSS alone enough to prioritize scan findings?

Neither is enough on its own. CVSS measures how severe a vulnerability is if exploited, and the CVSS v4.0 specification says its numerical scores rank severity relative to other vulnerabilities. EPSS estimates the probability that a published CVE will be exploited in the wild in the next 30 days. Severity tells you the impact if something goes wrong, while EPSS tells you how likely exploitation is right now. Most teams need both, plus asset context such as whether the system is internet-facing or holds regulated data. The CVSS specification also notes that factors such as regulatory requirements or breach losses sit outside its scope, so those must come from your own environment.

How much effort does a combined CVSS and EPSS rule take to set up?

The effort is mostly in agreeing the rule and wiring the data, not in the scoring itself. EPSS scores are free and openly available through CSV files, an API and a GitHub repository, so the data cost is low. The recurring work comes from deciding thresholds, mapping each finding to an owner and asset, and documenting exceptions. Setup effort rises with the number of scanners, asset sources and ticketing systems you need to connect, and with how many business-owner sign-offs the rule requires. Ask any provider to break the effort into one-time design, integration and recurring review, and to state which parts are included in a fixed-scope agreement.

What does the work need from our team before it can start?

It needs three things: an accurate asset inventory, named owners for each system, and agreed change windows. Without asset data, a high CVSS score can't be matched to whether the affected system is reachable or business-critical. Without owners, a ranked list produces no action. Change windows determine when fixes can land, which shapes the remediation SLA. Expect your team to supply scan exports, access to ticketing or tracking tools, and a decision-maker who can accept or reject exceptions. Your provider should list these inputs in the written scope so gaps are found before work begins.

How long does a review cycle take, and what drives its length?

Cycle length depends on how many findings you have, how many systems and owners are involved, and how often you re-score. EPSS publishes a score and percentile for every CVE every day, so scores can change between reviews, and a monthly or quarterly cycle needs a defined rule for when a finding is re-ranked. Drivers include the size of the estate, the quality of the asset data, the number of approvals, and whether fixes depend on change windows. Ask for the review cadence, the trigger for an out-of-cycle re-score, and the turnaround expected for each stage in the written scope.

Can our team set this up without outside help?

Yes, if you have people who can maintain the data pipeline, define the decision rule, and document exceptions. The public data and the CVSS and EPSS definitions are freely available, so the tooling barrier is low. The harder parts are the governance decisions: which combinations of severity and probability trigger which SLA, who approves deferrals, and how the rule is explained to auditors. Outside help is most useful when the rule must map to a compliance framework, when the estate is large or fragmented, or when internal staff are stretched. DeployOpen can plan, implement and document this work as a fixed-scope engagement, with ongoing support available as a retainer.

How do we ask for a quote based on a written scope?

Start by writing the scope down: the scanners and findings sources in use, the number of assets and owners, the ticketing systems to connect, the remediation SLA tiers, and the documents you need at the end. DeployOpen does not publish a price list, and a quote follows from that written scope, with deliverables and timelines agreed before work begins. Ask each provider to separate one-time work (rule design, integration, documentation) from recurring work (review cycles, data refresh, retainer support), to name what the client must supply, and to state what is excluded. Comparable scopes make quotes comparable.

Do EPSS scores change over time, and how does that affect audit evidence?

Yes. EPSS publishes a score and percentile for every CVE every day, so a finding can move up or down the queue between reviews. For audit evidence, record the score and percentile used at the decision date, the data source and retrieval date, and the rule that applied. A decision that was correct when made should remain traceable even if the score later changes. PCI SSC's penetration testing guidance expects reports to explain how severity or risk rankings were derived and to show traceable reasoning when scores are adjusted, so keep the same discipline for EPSS. Confirm the evidence format with your assessor before you design the logs.

How DeployOpen scopes, scores and supports vulnerability prioritization

DeployOpen plans, implements and documents vulnerability prioritization inside your own infrastructure, so CVSS scores, EPSS probabilities and your remediation SLA rules are set against your environment and your written scope. Engagements are fixed-scope, and the output is a process your team can run without us.

How we scope

The written scope names which scanners and penetration test sources feed the prioritization process for CVSS vs EPSS.
We agree which CVSS version and environmental metrics your team will record, and confirm who assigns them.
The scope states how EPSS data will be retrieved, refreshed and stored inside your network boundary.
Remediation SLA tiers for combined CVSS and EPSS outcomes are defined and approved before build work starts.

How we build

We configure ingestion of scanner and test findings so each record carries its CVSS and EPSS values with timestamps.
Scripts or pipeline jobs refresh EPSS data on your schedule, and the job logs confirm each run succeeded.
Ranking rules are implemented as documented logic, so an analyst can trace why a finding moved up or down.
Environmental adjustments are recorded with the reason, so the basis for any overridden score remains auditable.

How we hand over

Deliverables include a written method describing how CVSS and EPSS combine into each remediation SLA tier.
Runbooks cover the refresh job, exception handling for disputed scores, and how to review findings that change tier.
Your team receives a walkthrough with worked examples drawn from your own findings, labeled as internal test data.
Configuration and documentation are stored in your repositories, so ownership stays with your organization.

How we support

Ongoing support, upgrades and continuous testing of the prioritization pipeline are available as a retainer.
Retainer scope, response expectations and review cadence are written into the agreement before work begins.
We recommend your team confirm current EPSS and CVSS guidance with FIRST and your compliance assessor before changing SLA rules.

CVSS vs EPSS