Skip to content
ENExplore Calculators

Exploit Probability Calculator

Convert an EPSS 30-day score into the probability of exploitation over any horizon, adjusted for KEV listing and public exploit code.

About Exploit Probability Calculator

EPSS publishes one number for a 30-day window, which is awkward when your patch cycle is quarterly. Converting it to a constant daily hazard lets you re-express it over any horizon, and because the survival function is multiplicative, a 2% 30-day score is roughly 22% over a year rather than 24%. The multipliers are heuristic uplifts, not part of EPSS: a KEV listing means exploitation is already observed, so it dominates. A patch cycle is only defensible if the probability of exploitation across the cycle is acceptable — this is the number that tells you whether your quarterly window is a policy or a gamble.

Formulas

Exploit Probability

Daily hazard = 1 − (1 − EPSS)^(1/30). Adjusted hazard = daily × multiplier, capped at 0.95. Probability over d days = 1 − (1 − adjusted)^d.

EPSS
Published 30-day exploitation probability
daily hazard
Constant per-day probability implied by EPSS
multiplier
3× for KEV listing, 1–3.5× for exploit code maturity
d
Horizon in days

Expected time to exploitation

Expected days to first attempt = 1 ÷ adjusted daily hazard, the mean of the geometric distribution implied by a constant hazard.

Worked example

With the default values below, Exploit Probability Calculator returns Probability Over Your Horizon of 33.01%. Change any input above and every figure here is recalculated in your browser.

Inputs used

EPSS score (30-day probability)accepts 0–100 %
8 %
Horizon you care aboutaccepts 1–1,095 days
90 days
Listed in CISA KEV
No
Public exploit codeone of None published — ×1.0, Proof of concept on GitHub — ×1.6, Reliable Metasploit or Nuclei module — ×2.4, Bundled in commodity malware — ×3.5
Proof of concept on GitHub — ×1.6

Results

Probability Over Your Horizon
33.01%
Probability Within 12 Months
80.30%
Daily Hazard Rate
0.4441%
Expected Days to First Attempt
225 days
Applied Threat Multiplier
1.60 ×
Interpretation
Material probability — patch inside the horizon, not after it

Step by step

  1. 1Values used
  2. 2Exploit Probability
  3. 3Expected time to exploitation
  4. 4Probability Over Your Horizon= 33.01
  5. 5Probability Within 12 Months= 80.30
  6. 6Daily Hazard Rate= 0.4441
  7. 7Expected Days to First Attempt= 225 days
  8. 8Applied Threat Multiplier= 1.60 ×
  9. 9Interpretation= Material probability — patch inside the horizon, not after it

Assumptions and limits

  • The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 4 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Exploit Probability calculated?

Daily hazard = 1 − (1 − EPSS)^(1/30). Adjusted hazard = daily × multiplier, capped at 0.95. Probability over d days = 1 − (1 − adjusted)^d. EPSS publishes one number for a 30-day window, which is awkward when your patch cycle is quarterly. Converting it to a constant daily hazard lets you re-express it over any horizon, and because the survival function is multiplicative, a 2% 30-day score is roughly 22% over a year rather than 24%. The multipliers are heuristic uplifts, not part of EPSS: a KEV listing means exploitation is already observed, so it dominates.

Why does Exploit Probability matter?

A patch cycle is only defensible if the probability of exploitation across the cycle is acceptable — this is the number that tells you whether your quarterly window is a policy or a gamble.

What values do I need to enter?

This calculator takes 4 inputs: EPSS score (30-day probability), Horizon you care about, Listed in CISA KEV, Public exploit code. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Is a constant hazard rate realistic?

Not exactly. Real exploitation risk spikes shortly after a proof of concept appears and decays as fleets get patched. The constant-hazard conversion is the standard simplification and is conservative over short horizons, which is the direction you want to be wrong in.

Why does KEV listing multiply rather than set the probability to 100%?

Because KEV means the CVE is exploited somewhere in the world, not that it will be aimed at you. The 3× uplift on the hazard rate reflects a much higher chance of encountering it while keeping the arithmetic honest about targeting.

Related Calculators

Exploit Probability Calculator | Calcrivo