Convert an EPSS 30-day score into the probability of exploitation over any horizon, adjusted for KEV listing and public exploit code.
EPSS publishes one number for a 30-day window, which is awkward when your patch cycle is quarterly. Converting it to a constant daily hazard lets you re-express it over any horizon, and because the survival function is multiplicative, a 2% 30-day score is roughly 22% over a year rather than 24%. The multipliers are heuristic uplifts, not part of EPSS: a KEV listing means exploitation is already observed, so it dominates. A patch cycle is only defensible if the probability of exploitation across the cycle is acceptable — this is the number that tells you whether your quarterly window is a policy or a gamble.
Exploit Probability
Daily hazard = 1 − (1 − EPSS)^(1/30). Adjusted hazard = daily × multiplier, capped at 0.95. Probability over d days = 1 − (1 − adjusted)^d.
Expected time to exploitation
Expected days to first attempt = 1 ÷ adjusted daily hazard, the mean of the geometric distribution implied by a constant hazard.
Daily hazard = 1 − (1 − EPSS)^(1/30). Adjusted hazard = daily × multiplier, capped at 0.95. Probability over d days = 1 − (1 − adjusted)^d. EPSS publishes one number for a 30-day window, which is awkward when your patch cycle is quarterly. Converting it to a constant daily hazard lets you re-express it over any horizon, and because the survival function is multiplicative, a 2% 30-day score is roughly 22% over a year rather than 24%. The multipliers are heuristic uplifts, not part of EPSS: a KEV listing means exploitation is already observed, so it dominates.
A patch cycle is only defensible if the probability of exploitation across the cycle is acceptable — this is the number that tells you whether your quarterly window is a policy or a gamble.
This calculator takes 4 inputs: EPSS score (30-day probability), Horizon you care about, Listed in CISA KEV, Public exploit code. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Not exactly. Real exploitation risk spikes shortly after a proof of concept appears and decays as fleets get patched. The constant-hazard conversion is the standard simplification and is conservative over short horizons, which is the direction you want to be wrong in.
Because KEV means the CVE is exploited somewhere in the world, not that it will be aimed at you. The 3× uplift on the hazard rate reflects a much higher chance of encountering it while keeping the arithmetic honest about targeting.