EPSS

Deciding What to Patch First — CVSS, EPSS and KEV, and What Each Is For

CVSS is severity, EPSS is probability of exploitation, KEV is confirmed exploitation. They are not substitutes. Our own data across all 1,695 KEV entries: 64% score below CVSS 9 and 24% sit below EPSS 0.1 — so both 'patch the high scores' and 'ignore the low EPSS' fail in practice. Order by KEV, then EPSS, then CVSS, and set the deadline from your own exposure.