// GLOSSARY

EPSS (Exploit Prediction Scoring System)

A probability-based scoring system (maintained by FIRST) that estimates how likely a vulnerability is to be exploited in the wild in the near term, based on observed exploitation data. The classic impasse of patch prioritization is this: thousands of flaws, limited resources and the impossibility of closing them all at once. CVSS, which measures technical severity, does not resolve this impasse alone, because how serious a vulnerability is is a separate question from whether it will actually be exploited. A high-severity finding never exploited in the field and a medium-severity one that is widely exploited do not carry the same urgency. EPSS answers precisely this second question, 'how likely'; CVSS answers 'how bad'. Read together, the patch queue shifts from theoretical severity to real risk, and limited resources are directed first to the vulnerabilities actively exploited in the field.