Skip to content
ENExplore Calculators

EPSS Exploit Probability Calculator

Work out epss exploit probability instantly with clear inputs, formula shown and shareable results.

About EPSS Exploit Probability Calculator

EPSS estimates the probability that a vulnerability will be exploited in the wild within 30 days. Because it is a probability rather than a severity, it composes: across a population of vulnerabilities the expected count exploited is the sum of their scores, and the chance that at least one is hit rises quickly with volume even when each individual score is modest.

Formula

EPSS aggregation

probability over d days = 1 - (1 - EPSS)^(d/30); expected exploited = count x probability; P(at least one) = 1 - (1 - p)^count

Worked example

With the default values below, EPSS Exploit Probability Calculator returns Expected vulnerabilities exploited of 50.40. Change any input above and every figure here is recalculated in your browser.

Inputs used

EPSS scoreaccepts 0–1
0.42
Vulnerabilities with this scoreminimum 1
120
Horizonaccepts 1–365 days
30 days

Results

Expected vulnerabilities exploited
50.40
Exploitation probability over the horizon
42.00%
Probability at least one is exploited
100.000%
Prioritisation guidance
Elevated - prioritise above CVSS-only ranking

Step by step

  1. 1Values used
  2. 2EPSS aggregation
  3. 3Expected vulnerabilities exploited= 50.40
  4. 4Exploitation probability over the horizon= 42.00
  5. 5Probability at least one is exploited= 100.000
  6. 6Prioritisation guidance= Elevated - prioritise above CVSS-only ranking

Assumptions and limits

  • The result is derived only from the 3 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 3 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How does EPSS relate to CVSS?

They answer different questions. CVSS says how bad exploitation would be; EPSS says how likely it is. Using both cuts remediation workload dramatically compared with patching everything rated High.

Do most vulnerabilities have low EPSS scores?

Yes. The distribution is heavily skewed, with the large majority below 0.1, which is why EPSS is such an effective filter for a limited patching budget.

Related Calculators

EPSS Exploit Probability Calculator | Calcrivo