Glossary
EPSS (Exploit Prediction Scoring System)
A daily, data-driven probability that a published CVE will see exploitation activity in the next 30 days.
The Exploit Prediction Scoring System (EPSS) is produced by a FIRST special interest group. For each published CVE it provides a probability between 0 and 1 that exploitation activity will be observed in the next 30 days, together with a percentile ranking against all scored CVEs. Scores are recalculated daily and are available free through an API and bulk downloads.
EPSS answers a different question from CVSS: not "how bad would it be" but "how likely is it to be attempted". It says nothing about impact or about your environment, so it should be combined with severity and asset context rather than used alone.
In a VOC, EPSS is most useful for ranking the large middle of the backlog and as an early-warning signal: a sharply rising score is a good trigger to re-check a vulnerability's exploitation status. See risk-based prioritization.