What it does. Queries FIRST's Exploit Prediction Scoring System (EPSS) API to fetch exploitation-probability and percentile scores for CVEs, then uses those scores to prioritize vulnerability remediation. Use when triaging or ranking a vulnerability backlog by real-world 30-day exploitation likelihood rather than CVSS severity alone. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/implementing-epss-score-for-vulnerability-prioritization/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-epss-score-for-vulnerability-prioritization, or copy the skill folder into ~/.claude/skills/implementing-epss-score-for-vulnerability-prioritization/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-epss-score-for-vulnerability-prioritization/SKILL.md

SKILL.md (verbatim)

name: implementing-epss-score-for-vulnerability-prioritization
description: Queries FIRST's Exploit Prediction Scoring System (EPSS) API to fetch exploitation-probability and percentile scores for CVEs, then uses those scores to prioritize vulnerability remediation. Use when triaging or ranking a vulnerability backlog by real-world 30-day exploitation likelihood rather than CVSS severity alone.
domain: cybersecurity
subdomain: vulnerability-management
tags:
- epss
- vulnerability-prioritization
- first
- exploit-prediction
- cvss
- risk-based
- machine-learning
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- ID.RA-01
- ID.RA-02
- ID.IM-02
- ID.RA-06
mitre_attack:
- T1190
- T1203
- T1068

Implementing EPSS Score for Vulnerability Prioritization

Overview

The Exploit Prediction Scoring System (EPSS) is a data-driven model developed by FIRST (Forum of Incident Response and Security Teams) that estimates the probability of a CVE being exploited in the wild within the next 30 days. EPSS produces scores from 0.0 to 1.0 (0% to 100%) using machine learning trained on real-world exploitation data. Unlike CVSS which measures severity, EPSS measures likelihood of exploitation, making it essential for risk-based vulnerability prioritization.

When to Use

• When deploying or configuring implementing epss score for vulnerability prioritization capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• Python 3.9+ with requests, pandas, matplotlib
• Access to FIRST EPSS API (https://api.first.org/data/v1/epss)
• Vulnerability scan results with CVE identifiers
• Optional: NVD API key for CVSS enrichment

EPSS API Usage

Query Single CVE

# Get EPSS score for a specific CVE
curl -s "https://api.first.org/data/v1/epss?cve=CVE-2024-3400" | python3 -m json.tool

# Response:
# {
#   "status": "OK",
#   "status-code": 200,
#   "version": "1.0",
#   "total": 1,
#   "data": [
#     {
#       "cve": "CVE-2024-3400",
#       "epss": "0.95732",
#       "percentile": "0.99721",
#       "date": "2024-04-15"
#     }
#   ]
# }

Query Multiple CVEs

# Batch query up to 100 CVEs
curl -s "https://api.first.org/data/v1/epss?cve=CVE-2024-3400,CVE-2024-21887,CVE-2023-44228" | \
  python3 -c "
import sys, json
data = json.load(sys.stdin)
for item in data['data']:
    pct = float(item['epss']) * 100
    print(f\"{item['cve']}: {pct:.2f}% exploitation probability (percentile: {item['percentile']})\")
"

Download Full EPSS Dataset

# Download complete daily EPSS scores (CSV format)
curl -s "https://epss.cyentia.com/epss_scores-current.csv.gz" | gunzip > epss_scores_current.csv

# Check size and preview
wc -l epss_scores_current.csv
head -5 epss_scores_current.csv

Query Historical EPSS Scores

# Get EPSS score for a specific date
curl -s "https://api.first.org/data/v1/epss?cve=CVE-2024-3400&date=2024-04-12"

# Get time series data
curl -s "https://api.first.org/data/v1/epss?cve=CVE-2024-3400&scope=time-series"

Prioritization Strategy

EPSS + CVSS Combined Approach

EPSS Score	CVSS Score	Priority	Action
> 0.7	>= 9.0	P0 - Immediate	Remediate within 24 hours
> 0.7	>= 7.0	P1 - Urgent	Remediate within 48 hours
> 0.4	>= 7.0	P2 - High	Remediate within 7 days
> 0.1	>= 4.0	P3 - Medium	Remediate within 30 days
<= 0.1	>= 7.0	P3 - Medium	Remediate within 30 days
<= 0.1	< 7.0	P4 - Low	Remediate within 90 days

EPSS Percentile Thresholds

• Top 1% (percentile >= 0.99): Extremely likely to be exploited; treat as Critical
• Top 5% (percentile >= 0.95): High exploitation probability; prioritize remediation
• Top 10% (percentile >= 0.90): Elevated risk; schedule for near-term remediation
• Bottom 50%: Low exploitation probability; handle in normal patch cycle

Implementation

import requests
import pandas as pd
from datetime import datetime

def fetch_epss_scores(cve_list):
    """Fetch EPSS scores for a list of CVEs from FIRST API."""
    scores = {}
    batch_size = 100
    for i in range(0, len(cve_list), batch_size):
        batch = cve_list[i:i + batch_size]
        resp = requests.get(
            "https://api.first.org/data/v1/epss",
            params={"cve": ",".join(batch)},
            timeout=30
        )
        if resp.status_code == 200:
            for entry in resp.json().get("data", []):
                scores[entry["cve"]] = {
                    "epss": float(entry["epss"]),
                    "percentile": float(entry["percentile"]),
                    "date": entry.get("date", ""),
                }
    return scores

def prioritize_vulnerabilities(scan_results_csv, output_csv):
    """Enrich scan results with EPSS scores and assign priorities."""
    df = pd.read_csv(scan_results_csv)
    cve_list = df["cve_id"].dropna().unique().tolist()

    epss_data = fetch_epss_scores(cve_list)

    df["epss_score"] = df["cve_id"].map(lambda c: epss_data.get(c, {}).get("epss", 0))
    df["epss_percentile"] = df["cve_id"].map(lambda c: epss_data.get(c, {}).get("percentile", 0))

    def assign_priority(row):
        epss = row.get("epss_score", 0)
        cvss = row.get("cvss_score", 0)
        if epss > 0.7 and cvss >= 9.0:
            return "P0"
        if epss > 0.7 and cvss >= 7.0:
            return "P1"
        if epss > 0.4 and cvss >= 7.0:
            return "P2"
        if epss > 0.1 or cvss >= 7.0:
            return "P3"
        return "P4"

    df["priority"] = df.apply(assign_priority, axis=1)
    df = df.sort_values(["priority", "epss_score"], ascending=[True, False])
    df.to_csv(output_csv, index=False)
    print(f"[+] Prioritized {len(df)} vulnerabilities -> {output_csv}")
    print(f"    P0: {len(df[df['priority']=='P0'])}")
    print(f"    P1: {len(df[df['priority']=='P1'])}")
    print(f"    P2: {len(df[df['priority']=='P2'])}")
    print(f"    P3: {len(df[df['priority']=='P3'])}")
    print(f"    P4: {len(df[df['priority']=='P4'])}")
    return df

EPSS Trend Analysis

def fetch_epss_timeseries(cve_id):
    """Get historical EPSS scores for trend analysis."""
    resp = requests.get(
        "https://api.first.org/data/v1/epss",
        params={"cve": cve_id, "scope": "time-series"},
        timeout=30
    )
    if resp.status_code == 200:
        return resp.json().get("data", [])
    return []

def detect_epss_spikes(cve_id, threshold=0.3):
    """Detect significant EPSS score increases indicating emerging threats."""
    timeseries = fetch_epss_timeseries(cve_id)
    if len(timeseries) < 2:
        return False
    sorted_data = sorted(timeseries, key=lambda x: x.get("date", ""))
    latest = float(sorted_data[-1].get("epss", 0))
    previous = float(sorted_data[-2].get("epss", 0))
    increase = latest - previous
    if increase >= threshold:
        print(f"[!] EPSS spike detected for {cve_id}: {previous:.3f} -> {latest:.3f} (+{increase:.3f})")
        return True
    return False

References

• FIRST EPSS Official
• EPSS API Documentation
• EPSS Model Documentation
• EPSS Data Downloads
• Cyentia Institute Research

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

EPSS Vulnerability Prioritization Policy Template

Priority Matrix

Priority	EPSS Threshold	CVSS Range	KEV Status	Remediation SLA
P0 - Immediate	> 0.70	>= 9.0	Any	24 hours
P0 - Immediate	Any	Any	In KEV + Critical CVSS	24 hours
P1 - Urgent	> 0.70	>= 7.0	Any	48 hours
P1 - Urgent	Any	Any	In KEV	48 hours
P2 - High	> 0.40	>= 7.0	Not in KEV	7 days
P3 - Medium	> 0.10	>= 4.0	Not in KEV	30 days
P3 - Medium	<= 0.10	>= 7.0	Not in KEV	30 days
P4 - Low	<= 0.10	< 7.0	Not in KEV	90 days

Daily EPSS Enrichment Schedule

# crontab entry for daily EPSS enrichment
0 6 * * * /opt/vuln-mgmt/scripts/process.py --input /data/open_vulns.csv --output /data/prioritized.csv --bulk

Input CSV Format

cve_id,host,port,cvss_score,severity,description
CVE-2024-3400,fw-01.corp.local,443,10.0,critical,PAN-OS command injection
CVE-2024-21887,vpn-01.corp.local,443,9.1,critical,Ivanti Connect Secure auth bypass
CVE-2023-44228,app-01.corp.local,8080,10.0,critical,Log4Shell RCE

EPSS Score Interpretation Guide

EPSS Range	Interpretation	Recommended Action
0.90 - 1.00	Near certainty of exploitation	Immediate patching or isolation
0.70 - 0.89	Very high exploitation probability	Priority remediation queue
0.40 - 0.69	Significant exploitation risk	Accelerated remediation
0.10 - 0.39	Moderate exploitation probability	Standard remediation cycle
0.01 - 0.09	Low exploitation probability	Normal patch cycle
0.00 - 0.009	Negligible exploitation probability	Best-effort remediation

references/api-reference.md (verbatim)

API Reference — Implementing EPSS Score for Vulnerability Prioritization

Libraries Used

• requests: HTTP client for FIRST.org EPSS API
• csv: Parse and enrich vulnerability scan CSV files

CLI Interface

python agent.py score --cves CVE-2024-1234 CVE-2024-5678
python agent.py enrich --scan-file scan.csv [--output enriched.csv]

Core Functions

get_epss_scores(cve_list)

Fetches EPSS scores from the FIRST.org API (batches of 100).

API Endpoint: GET https://api.first.org/data/v1/epss?cve=CVE-1,CVE-2

Returns: dict with scores list, each containing cve, epss (0.0-1.0), percentile (0.0-1.0).

prioritize_vulnerabilities(cve_scores, epss_threshold=0.1, percentile_threshold=0.9)

Classifies CVEs into priority buckets based on EPSS probability.

Priority Buckets:

Priority	Criteria
CRITICAL	EPSS >= 0.1 or percentile >= 90th
HIGH	EPSS >= 0.05
MEDIUM	EPSS >= 0.01
LOW	EPSS < 0.01

enrich_from_scan(scan_file, output_file=None)

Reads a CSV vulnerability scan, fetches EPSS for all CVEs, and writes enriched output.

Auto-detects columns: CVE, cve, CVE-ID, cve_id, vulnerability_id.

FIRST.org EPSS API

Parameter	Description
cve	Comma-separated CVE IDs (max 100 per request)
envelope	Wrap response in metadata envelope
date	Get scores for a specific date (YYYY-MM-DD)

Response Fields:

• epss: Probability of exploitation in next 30 days (0.0–1.0)
• percentile: Percentile rank relative to all scored CVEs

Dependencies

pip install requests>=2.31

references/standards.md (verbatim)

Standards and References - EPSS Vulnerability Prioritization

Primary Standards

FIRST EPSS

• Source: Forum of Incident Response and Security Teams
• URL: https://www.first.org/epss/
• API: https://api.first.org/data/v1/epss
• Model: Machine learning trained on real exploitation events, updated daily
• Versions: v1 (2021), v2 (2022), v3 (2023), v4 (2025)

CVSS v3.1 and v4.0

• Source: FIRST
• URL: https://www.first.org/cvss/
• Relevance: EPSS complements CVSS; CVSS measures severity, EPSS measures exploitation probability

CISA Stakeholder-Specific Vulnerability Categorization (SSVC)

• URL: https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc
• Relevance: SSVC uses exploitation status as a key decision point; EPSS provides data-driven input

CISA Known Exploited Vulnerabilities (KEV)

• URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Relevance: KEV confirms active exploitation; EPSS predicts future exploitation probability

Research Papers

Original EPSS Paper

• Title: "Improving Vulnerability Remediation Through Better Exploit Prediction"
• Authors: Jay Jacobs, Sasha Romanosky, Benjamin Edwards, Michael Roytman, Idris Adjerid
• Published: Workshop on the Economics of Information Security (WEIS), 2021

EPSS v3 Model

• Features: 1,477 features including CVE properties, vendor data, social media mentions, exploit code availability
• Training Data: Historical exploitation events from multiple sources
• Performance: AUC of 0.85+ for 30-day exploitation prediction

Data Sources Used by EPSS

Source	Data Type	Update Frequency
NVD	CVE metadata, CVSS scores	Real-time
CISA KEV	Confirmed exploitation	As new CVEs added
Exploit-DB	Public exploit code	Daily
GitHub	Exploit PoC repositories	Daily
Metasploit	Exploit modules	Weekly
SecurityFocus	Vulnerability discussions	Daily
Social Media	Twitter/X mentions of CVEs	Real-time
Fortinet	Exploitation telemetry	Daily
AlienVault OTX	Threat intelligence	Daily

API Reference

Endpoints

• Single CVE: GET https://api.first.org/data/v1/epss?cve=CVE-YYYY-NNNNN
• Multiple CVEs: GET https://api.first.org/data/v1/epss?cve=CVE-1,CVE-2,...
• Date-specific: GET https://api.first.org/data/v1/epss?cve=CVE-YYYY-NNNNN&date=YYYY-MM-DD
• Time series: GET https://api.first.org/data/v1/epss?cve=CVE-YYYY-NNNNN&scope=time-series
• Top scoring: GET https://api.first.org/data/v1/epss?percentile-gt=0.95
• Full download: https://epss.cyentia.com/epss_scores-current.csv.gz

references/workflows.md (verbatim)

Workflows - EPSS Vulnerability Prioritization

Workflow 1: Daily EPSS Enrichment Pipeline

Steps

1. Download full EPSS dataset from https://epss.cyentia.com/epss_scores-current.csv.gz
2. Load into local database for fast lookups
3. Query open vulnerabilities from vulnerability management platform
4. Enrich each CVE with current EPSS score and percentile
5. Apply priority matrix combining EPSS and CVSS scores
6. Update priority fields in DefectDojo/Jira/tracking system
7. Alert on any CVEs that crossed EPSS threshold (e.g., jumped above 0.4)

Workflow 2: EPSS Spike Detection

Steps

1. Compare today's EPSS scores against yesterday's scores for all open CVEs
2. Identify CVEs with EPSS increase > 0.2 in past 24 hours
3. Cross-reference spike CVEs with asset inventory
4. Send high-priority alert for spiking CVEs affecting production assets
5. Automatically escalate to P1 if EPSS crosses 0.7 threshold

Workflow 3: Prioritized Remediation Report

Steps

1. Pull all open vulnerabilities from scanner
2. Enrich with EPSS scores and CISA KEV membership
3. Apply combined EPSS + CVSS + KEV priority matrix
4. Group by priority tier (P0-P4)
5. Within each tier, sort by EPSS score descending
6. Generate report showing estimated risk reduction per remediation action
7. Distribute to asset owners with assigned remediation timelines

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.