Prioritize Vulnerabilities with DVE and EPSS Scoring Systems

Ingrid

Two scores estimate how likely a vulnerability is to be exploited: the Dynamic Vulnerability Exploit (DVE) score and the Exploit Prediction Scoring System (EPSS) percentage. Both predict exploitation over a future time frame. They do not only report past exploitation.

This article describes what each score measures and how to use them to plan remediation.

Which System Is Better at Predicting Exploitation?

DVE and EPSS are trained and validated on disparate datasets. Not all frameworks can reflect the biases in the training data since there's no authoritative visibility into the sum of exploitation activity.

Use DVE to plan remediation based on threat intelligence (TI), such as CTI or other TI feeds. This may be useful during major security events, such as zero-days, vulnerabilities that are changing in real-time, and when vulnerabilities are first published.
Use EPSS to plan remediation based on vulnerability characteristics and prioritize interoperability with other tools and industry standardization.

Dynamic Vulnerability Exploit (DVE)

DVE models exploitation activity based on threat intelligence. It observes attackers discussing, planning, and weaponizing exploits, and measures the systemic relationship between those observations and exploitation activity, to make a prediction about which vulnerabilities will be targeted by attackers.

DVE predicts likelihood of exploitation in a 90-day period. It is presented as a 0-10 score, with 10 indicating a higher likelihood of exploitation.

CTI attributes that make up a DVE score

The following CTI attributes contribute to the DVE score. Each attribute lists its API slug name.

Trending attributes can be added or removed at any time as activity changes.

Attribute	What it means	Slug name	Persistence
Exploited in the Wild	The vulnerability has been exploited at least once.	has_exploit_in_the_wild_attribute	Persists once seen
Has POC Exploit	The vulnerability has at least one published proof-of-concept (POC) exploit.	has_poc_exploit_attribute	Persists once seen
Metasploit Mention	Metasploit, a computer security project owned by Rapid7 that supports penetration testing and IDS signature development, has mentioned the vulnerability.	metasploit_attribute	Persists once seen
Part of Exploit Kit	The vulnerability is part of at least one exploit kit.	has_exploit_kit_attribute	Persists once seen
Related to APT	The vulnerability appears in content related to advanced persistent threats (APT).	is_related_apt_attribute	Persists once seen
Related to Ransomware	The vulnerability appears in ransomware-related content.	is_related_ransomware_attribute	Persists once seen
Scanned by Anonymous	The hacktivist collective Anonymous has scanned the vulnerability at least once.	is_scanned_by_anonymous_attribute	Persists once seen
Trending in Arab Underground	The vulnerability is trending in Arab Underground dark web forums.	is_trend_arabic_attribute	Trending, can be removed
Trending in Chinese Underground	The vulnerability is trending in Chinese Underground dark web forums.	is_trend_chinese_attribute	Trending, can be removed
Trending in Cyber Underground	The vulnerability is trending in cyber underground dark web forums.	is_trend_underground_attribute	Trending, can be removed
Trending in Farsi Underground	The vulnerability is trending in Farsi Underground dark web forums.	is_trend_farsi_attribute	Trending, can be removed
Trending in Russian Underground	The vulnerability is trending in Russian Underground dark web forums.	is_trend_russian_attribute	Trending, can be removed
Trending on GitHub	The vulnerability is trending on GitHub, a platform developers use to store, manage, and share code.	is_trend_github_general_attribute	Trending, can be removed
Trending on Twitter	The vulnerability is trending on X (formerly Twitter).	is_trend_twitter_attribute	Trending, can be removed
Verified Exploit	An exploit for the vulnerability is verified by ExploitDB.	is_verified_exploit	Persists once seen

Trending attributes can be added or removed at any time as activity changes. Other attributes stay once seen because the condition is permanent.

Exploit Prediction Scoring System (EPSS)

EPSS models exploitation activity based on vulnerability properties and characteristics. It uses the correlation between what a vulnerability is like and past exploitation attempts to predict how likely a vulnerability with these given characteristics is to be exploited.

EPSS predicts likelihood of exploitation in a 30-day period, calculated every 24 hours. The EPSS % estimates the likelihood that a software will be exploited to better prioritize vulnerability remediation efforts. The higher the percentage the more likely it is to be exploited.

Publish Date or Recent Edits

April 4, 2025: CTI slug names for the API.
April 3, 2025: Published.