The Exploit Prediction Scoring System (EPSS) is a method used to predict how likely a malicious actor will abuse a system vulnerability. Imagine a long list of security weaknesses if you will. EPSS aids in vulnerability management by helping security teams decide which weaknesses are most likely to cause trouble.
To do that, the EPSS model is powered by machine learning (ML) algorithms that analyze several types of information, including real-world vulnerability exploitation data. EPSS is commonly used alongside the Common Vulnerability Scoring System (CVSS) to rank system vulnerabilities. While EPSS computes the likelihood of a vulnerability exploitation, CVSS looks at its potential impact.
Read More about the Exploit Prediction Scoring System
We’ll discuss EPSS in greater detail below.
Who Created the Exploit Prediction Scoring System (EPSS)?
EPSS was developed through a collaborative effort by various cybersecurity researchers and organizations. It is governed by the Forum of Incident Response and Security Teams (FIRST), a nonprofit organization that focuses on improving incident response and security practices.
FIRST has more than 750 teams in 111 different countries. Many of the teams are from global companies like Accenture, Apple, and Microsoft. Several government organizations are also members, including the United Kingdom’s National Cyber Security Centre, the North Atlantic Treaty Organization (NATO) Cyber Security Centre, and the National Institute of Standards and Technology (NIST).
How Are EPSS Scores Calculated?
EPSS scores are computed through a complex process involving ML and data analysis. The first step is collecting vast amounts of data, including information about vulnerabilities; their characteristics like age, severity, and software type; and real-world exploitation attempts.
An ML model is then trained on this data to identify patterns and relationships between vulnerabilities and their likelihood of getting exploited. Each vulnerability is analyzed based on its characteristics, which are then compared with patterns learned from the data analysis.
Based on this comparison, the model assigns a probability score between 0 and 1, indicating the likelihood that a vulnerability will get exploited within a specific timeframe (usually 30 days).
How Does the EPSS Model Categorize Vulnerabilities?
Among the factors that affect the EPSS model are the types of vulnerabilities it analyzes. The model classifies them as false positives, true positives, false negatives, and true negatives.
True positives (TPs) are vulnerabilities that have been correctly identified as high-risk and indeed exploited. These are the “good calls” in vulnerability prioritization.
False positives (FPs) are vulnerabilities that were mistakenly flagged as high-risk but never actually exploited. These represent wasted effort and resources.
False negatives (FNs) are vulnerabilities that were overlooked but subsequently exploited. These are missed opportunities for prevention and can have serious consequences.
True negatives (TNs) are vulnerabilities correctly identified as low-risk and never exploited. These decisions were accurate.
What Metrics Does the EPSS Model Track?
Using the four categories above, the EPSS model analyzes three metrics—effort, efficiency, and coverage.
Effort represents the proportion of vulnerabilities selected for remediation, while efficiency measures how well resources are used. It assesses the percentage of prioritized vulnerabilities that have actually been exploited. A high efficiency score indicates that resources were allocated to the most critical issues.
Meanwhile, coverage measures the percentage of exploited vulnerabilities included in the prioritized list. High coverage indicates that a strategy effectively identifies critical threats. Low coverage means many exploited vulnerabilities were missed.
Why Do EPSS Scores Change Over Time?
It’s important to note that EPSS scores are dynamic and can change over time as new information becomes available. As new vulnerabilities get discovered, they are added to the EPSS model, affecting the overall score distribution.
Threat actor activity also contributes to EPSS score changes. If a vulnerability is actively exploited in the wild, its EPSS score will likely increase.
The EPSS model is also continually refined and improved, which can lead to changes in scores. Therefore, it’s crucial to regularly check EPSS scores to stay updated on the evolving threat landscape.
—
EPSS is a valuable tool for prioritizing vulnerability remediation, allowing organizations to allocate resources effectively. While not infallible, it significantly enhances cybersecurity strategies when used alongside other risk assessment methods.
Key Takeaways
- EPSS uses ML to analyze data and predict how likely attackers are to exploit a vulnerability.
- It was developed by the cybersecurity community and governed by the nonprofit organization FIRST.
- EPSS assigns a score (0–1) indicating the likelihood of exploitation within 30 days.
- While CVSS measures potential impact, EPSS focuses on the likelihood of exploitation.
- EPSS scores are dynamic and constantly change based on new vulnerabilities, exploit activity, and model updates.
Sources
- https://www.first.org/epss/model
- https://www.first.org/epss/#:~:text=The%20Exploit%20Prediction%20Scoring%20System,be%20exploited%20in%20the%20wild.
- https://www.splunk.com/en_us/blog/learn/epss-exploit-prediction-scoring-system.html
