Security · Flashcard
What does an EPSS score estimate?
- AThe probability that a vulnerability will be exploited in the wild in the near term
- BThe proportion of an organisation's assets that run the affected component version
- CThe severity of the impact should an attacker successfully exploit the vulnerability
- DThe time a typical engineering team needs to remediate the vulnerability fully
Why this is the answer
EPSS is a predictive probability between 0 and 1 that exploitation will be observed within a short forward window, built from observed attack data. Asset coverage is inventory, impact is what CVSS scores, and remediation effort is not something EPSS models — conflating probability with severity is the usual mistake.
Official docs