EPSS score provides information about what aspect of a vulnerability?

• A. Ease of exploitation.
• B. Likelihood that an exploit exists against the vulnerability.
• C. Severity based on CVSS.
• D. Time to patch.

Answer: (B)

The main idea behind EPSS is to quantify how likely a vulnerability is to be exploited in the wild within a given timeframe. This score helps prioritize remediation by focusing on exploitation risk rather than just how severe or easy a vulnerability is to exploit. EPSS uses historical exploit data and observed trends to estimate the probability that attackers will exploit the vulnerability soon, which is why the score reflects the likelihood of an exploit existing or being used. It’s not about how severe the vulnerability is (that’s what CVSS base/temporal metrics cover), nor about how easy it is to exploit, nor about how long it will take to patch.