EPSS Vulnerability Prioritization: Patch What Actually Gets Exploited (2026)

CVSS — the Common Vulnerability Scoring System — measures how much damage a vulnerability could do if someone exploited it. That is a useful question, but it is not the question a short-staffed IT team needs answered on a Tuesday morning. CVSS is a static severity rating assigned near disclosure. It does not know whether exploit code was published, whether a ransomware crew adopted it, or whether the flaw sits in software your business actually runs.

The practical result is a bottleneck. Industry reporting consistently shows that only a small fraction of published CVEs are ever exploited in the wild, yet a large share of them carry High or Critical CVSS ratings. Sort by CVSS and your remediation queue is mostly noise. Worse, it is demoralizing noise — teams that can never clear the board stop trusting the board, and genuine emergencies get lost in the backlog alongside a decade-old flaw in a service you disabled years ago.

The Exploit Prediction Scoring System takes a different angle. EPSS produces a score from 0 to 1 representing the probability that a given CVE will be exploited in the wild within the next 30 days. The model is trained on real-world exploitation telemetry and refreshed daily, so a vulnerability's score moves as the threat landscape moves.

• It is probabilistic, not categorical. An EPSS score of 0.87 means roughly an 87% chance of observed exploitation activity in the next month. A score of 0.002 means it is very likely nobody will bother.
• It updates daily. A CVE that was quiet in March can spike in July when proof-of-concept code hits public repositories. Your prioritization should move with it.
• It complements CVSS. EPSS tells you likelihood; CVSS tells you consequence. Risk is the product of both, and you need both halves.
• It is free and public. There is no license to buy. Most modern scanners already surface EPSS alongside CVSS, and the data is available by API if yours does not.

Alongside EPSS sits CISA's Known Exploited Vulnerabilities catalog — a curated list of flaws with confirmed, observed exploitation. KEV is not predictive; it is a record of what has already happened. Anything on KEV that touches your environment is an emergency regardless of what any score says.

You do not need a data science function to use this. A workable model sorts findings into four lanes and assigns each lane a service-level target your team can defend in a board meeting or an insurance questionnaire.

1. Lane 1 — Emergency (patch in 72 hours): On the CISA KEV catalog, or EPSS above 0.5, and internet-facing. This is where edge devices, remote access appliances, and public web applications live. Our guide to edge device exploitation defense covers why this asset class earns its own fire drill.
2. Lane 2 — Urgent (patch in 14 days): EPSS above 0.1 with CVSS High or Critical, on any asset holding sensitive data or privileged credentials.
3. Lane 3 — Scheduled (next monthly cycle): Everything else with a meaningful CVSS rating. Batch it into your normal patch window and stop treating it as an interrupt.
4. Lane 4 — Accept and document: Low EPSS, low exposure, compensating controls in place. Write down the decision and the reasoning. An accepted risk you documented is a defensible position; an accepted risk you never noticed is a finding.

The thresholds are yours to tune. A law firm holding privileged client data will set them tighter than a light-industrial shop. What matters is that the thresholds exist, are written down, and are applied consistently.

EPSS tells you what attackers are doing globally. It knows nothing about your network. A CVE with a 0.9 EPSS score in a product you do not run is worth exactly zero minutes of attention, and a 0.05 score on the domain controller everything authenticates against deserves a closer look than the number implies.

That means the real prerequisite for good prioritization is knowing what you own. If your asset list is a spreadsheet somebody last updated in 2024, every score you compute is applied to a fiction. Disciplined IT asset lifecycle management is what turns threat data into action, and layering in ZTNA in place of flat VPN access reduces what a single unpatched host can reach when you inevitably miss one.

Three context factors should raise or lower any finding's lane assignment:

• Exposure. Internet-facing beats internal. Internal beats isolated segment.
• Blast radius. Identity infrastructure, hypervisors, and backup systems are force multipliers for an attacker. Treat them accordingly — this is the same logic behind privileged access management.
• Compensating controls. A flaw behind strong MFA, segmentation, and monitoring is genuinely less urgent than the same flaw sitting bare.

Sometimes the vendor has no fix, or the patch breaks a line-of-business application you cannot take down mid-quarter. Prioritization has to include a plan for those cases, because "we are waiting on the vendor" is not a control.

• Restrict access at the network layer — take the vulnerable service off the public internet, even temporarily.
• Apply vendor workarounds or configuration hardening where a code fix is unavailable.
• Increase monitoring specifically for exploitation indicators on the affected host. Your monitoring stack and network technology services need to actually cover that system for this to mean anything.
• Verify your recovery path. Tested, immutable backups are what turn a successful exploit into a bad week instead of a business-ending event.

Document every mitigation with an owner and a revisit date. Temporary controls become permanent gaps the moment nobody is accountable for removing them.

Your owner, your board, and your cyber insurance carrier do not want a scanner export. They want to know whether the business is exposed and whether the trend is improving. EPSS makes that conversation dramatically easier, because you can report on a small, meaningful number instead of an unmanageable one.

A monthly one-page summary works: count of open Lane 1 and Lane 2 findings, mean time to remediate each lane, number of accepted risks with documented rationale, and any KEV-listed exposure. That format maps cleanly onto what auditors and underwriters ask for — the same evidence discipline that shows up in CIS Controls implementation groups and in the questionnaires behind cyber insurance requirements. Carriers increasingly ask how you prioritize remediation, not just whether you patch. "We use EPSS and KEV against a documented asset inventory with defined SLAs" is a materially better answer than "we patch monthly."

Pick one week and do this in order. First, pull your current scanner output and enrich it with EPSS scores — most platforms have a column or filter for it already. Second, cross-reference against the CISA KEV catalog. Third, filter to internet-facing assets only. The list you are left with is almost certainly small enough to fix, and it is the list that actually matters.

From there, write the four lanes and their SLAs into a one-page standard and hold your monthly patch cycle to it. If your team does not have capacity to run this consistently, that is exactly the work a managed provider absorbs. LayerLogix builds vulnerability prioritization into our cybersecurity services, backed by the monitoring and patch operations inside managed IT services and the audit-evidence discipline of our compliance practice. Houston businesses comparing options can start with the Houston managed IT services overview.

• Managed IT services in Houston
• Managed IT services in The Woodlands
• Managed IT services in Sugar Land