Exploit Probability Calculator

Daily hazard = 1 − (1 − EPSS)^(1/30). Adjusted hazard = daily × multiplier, capped at 0.95. Probability over d days = 1 − (1 − adjusted)^d. EPSS publishes one number for a 30-day window, which is awkward when your patch cycle is quarterly. Converting it to a constant daily hazard lets you re-express it over any horizon, and because the survival function is multiplicative, a 2% 30-day score is roughly 22% over a year rather than 24%. The multipliers are heuristic uplifts, not part of EPSS: a KEV listing means exploitation is already observed, so it dominates.

A patch cycle is only defensible if the probability of exploitation across the cycle is acceptable — this is the number that tells you whether your quarterly window is a policy or a gamble.

This calculator takes 4 inputs: EPSS score (30-day probability), Horizon you care about, Listed in CISA KEV, Public exploit code. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Not exactly. Real exploitation risk spikes shortly after a proof of concept appears and decays as fleets get patched. The constant-hazard conversion is the standard simplification and is conservative over short horizons, which is the direction you want to be wrong in.

Because KEV means the CVE is exploited somewhere in the world, not that it will be aimed at you. The 3× uplift on the hazard rate reflects a much higher chance of encountering it while keeping the arithmetic honest about targeting.