Exploit Prediction Scores Screensaver
The Exploit Prediction Scores screensaver shows fIRST's EPSS model estimates the chance each vulnerability is exploited in the wild within 30 days. This ranks likelihood, a different question from what was published or what maintainers advised. It's free, runs in your browser, and ESC exits.
Live preview
Press ESC to leave fullscreen. Settings are saved in your browser only.
How the Exploit Prediction Scores screensaver works
The saver reads FIRST's EPSS API directly in your browser — no key and no account.
FIRST's EPSS model estimates the chance each vulnerability is exploited in the wild within 30 days.
It refreshes on a schedule, so what you see stays current.
Colours can be changed in settings; nothing is stored beyond your own browser.
What an EPSS score is, and is not
The Exploit Prediction Scoring System (EPSS) is directed by an EPSS Special Interest Group at FIRST, the Forum of Incident Response and Security Teams, while Empirical Security generates the scores and publishes them free of charge. For every publicly disclosed CVE it outputs a value from 0 to 1: the estimated probability that the vulnerability will be exploited in the wild within the next 30 days.
The model uses properties of each vulnerability, including the individual CVSS metrics (not the CVSS score), together with current threat-intelligence signals such as exploit code availability, discussion volume and references. It is retrained when monitoring shows its performance degrading, which in practice has happened about once a year. Scores are regenerated every day, usually shortly after 13:30 UTC.
Alongside the score there is a percentile, which ranks a CVE against all currently scored ones. Because most CVEs are rarely exploited, a score of about 0.10 already sits near the 95th percentile. EPSS answers a different question from CVSS: CVSS is meant to measure severity, EPSS estimates likelihood, and FIRST’s FAQ describes the two as empirically uncorrelated. EPSS also covers only the threat side. It does not measure impact or account for your own environment.
A worked example
FIRST's EPSS model estimates the chance each vulnerability is exploited in the wild within 30 days. This ranks likelihood, a different question from what was published or what maintainers advised.
Settings & tips
- Accent and Background recolour the display.
- Data comes straight from FIRST's EPSS API in your browser.
- Press ESC to leave fullscreen.
Frequently asked questions
- Is this real data?
- Yes — it comes from FIRST's EPSS API and is refreshed on a schedule.
- Does a high score mean a flaw is severe?
- No. EPSS estimates how likely exploitation is, which is a separate question from how damaging it would be. A low-severity flaw can score high, and the reverse.
- Is a key needed?
- No. This source is fully key-less.
- Is it free?
- Yes — free, no download, in your browser.
- How is EPSS different from CVSS?
- CVSS is intended to measure how severe a vulnerability is, while EPSS estimates how likely it is to be exploited in the wild within 30 days. FIRST’s FAQ describes the two as empirically uncorrelated, so one cannot stand in for the other.
- What does a score of 0.5 mean?
- It is the model’s estimated probability, about 50 percent, that the vulnerability will be exploited in the wild within the next 30 days. It is an estimate, not a certainty either way. Most CVEs score far lower.
- Why can a score change from day to day?
- Scores are regenerated every day. Changes come from new signals such as exploit code appearing, more discussion or new references, not from a newly observed attack on that day.