All guides
← All guides

EPSS & KEV: real-world exploitability

Cross-cuttingDraugr: available today

In plain terms#

The CVSS base score tells you how bad a vulnerability could be in the abstract. Two signals tell you how likely it is to bite you, and they are the real-world temporal dimension of risk (as opposed to your environmental context):

  • EPSS (Exploit Prediction Scoring System) is a probability, from 0 to 1, that a given CVE will be exploited in the wild in the next 30 days, produced by a data-driven model from FIRST.
  • KEV (Known Exploited Vulnerabilities) is CISA's authoritative list of vulnerabilities that are being exploited right now.

Why it matters#

Only a small fraction of all CVEs are ever exploited. Sorting purely by the CVSS base score means spending effort on "critical" vulnerabilities that no attacker has ever bothered with, while a "medium" that's on the KEV list, and so being actively exploited, waits in the backlog. EPSS and KEV re-focus attention on the vulnerabilities that pose real risk today.

  • KEV is binary and high-confidence. If it's on the list it is being exploited, so treat it as urgent, regardless of its CVSS.
  • EPSS is a dial, where a high score means "attackers are likely to weaponize this soon."

Where it fits#

These aren't scanners but enrichment. You take the CVEs your SCA and image scans already found, and cross-reference them against KEV and EPSS to sharpen priority.

How it works#

Both are published as freely downloadable data feeds (CISA's KEV as JSON, EPSS as a daily CSV of scores per CVE). A prioritization step joins your findings' CVE IDs against these feeds and escalates or de-escalates accordingly.

Common pitfalls#

  • EPSS is a probability, not a guarantee. A low score isn't "safe," just "less likely."
  • Feeds go stale. EPSS updates daily and KEV grows continuously; use current data.
  • Temporal, not environmental. EPSS and KEV tell you whether a vulnerability is being exploited somewhere, rather than whether it's reachable or business-critical in your system. Combine this temporal signal with your environmental context, meaning exposure and criticality for the full picture.
How Draugr fits. Draugr fetches both feeds for you with draugr feeds update, and you turn them on once in the descriptor, under config.exploitability. A CVE on KEV becomes critical; a CVE at or above your EPSS threshold is raised one band. The scan itself never reaches the network: it reads the cached copy, so a gated run stays reproducible and works on an air-gapped runner. Each finding that moved says why it moved, ranked as critical, on KEV (2026-08-01), because a priority you can't check is a hint rather than evidence. See using KEV and EPSS in a scan in the docs.

Keep learning#