EPSS score
Learn how EPSS scores help prioritize vulnerabilities based on exploitation likelihood.
Harness STO helps you identify security issues early in the pipeline by shifting vulnerability management left. However, identifying vulnerabilities alone is not sufficient. Prioritizing them based on risk is equally important.
STO also surfaces CISA KEV status for CVE-associated issues. EPSS predicts exploitation likelihood; CISA KEV confirms whether CISA has documented active exploitation. Use both signals together when you prioritize remediation.
What is EPSS score?
To support risk-based prioritization, Harness STO surfaces the Exploit Prediction Scoring System (EPSS) score on the Issues and Vulnerabilities pages. EPSS provides:
Probability: The likelihood (0–100%) that a Common Vulnerabilities and Exposures (CVE) will be exploited in the wild within the next 30 days.
Percentile: The relative ranking of the CVE’s exploitation likelihood compared to other CVEs.
Most vulnerabilities, including High or Critical issues rated by the Common Vulnerability Scoring System (CVSS), are never exploited in the wild. A vulnerability can have a CVSS score of 9 or 10 yet remain unlikely to be exploited. EPSS uses risk-based signals to help you prioritize real-world exploitation.
View EPSS scores
In the Issues section, select an issue to open the Issue Details panel. You can view the EPSS score for issues with a CVE ID. You can also view EPSS scores on the Vulnerabilities tab. Apply filters based on EPSS probability and percentile.
Enforce an OPA policy
Block vulnerabilities based on EPSS probability and percentile with an OPA policy. Navigate to Account Settings, select Policies, and search for the EPSS policy. Open the policy and configure the maximum EPSS threshold and percentile. The policy blocks vulnerabilities that exceed those values.
Last updated
Was this helpful?