Microproduct data guidebeginner

FIRST Exploit Prediction Scoring System

Daily CVE exploit-probability scores for building patch-priority queues that go beyond severity ratings and known-exploited lists.

Start the guide Open official source

At a glance

Difficulty
Beginner — comfortable for a first prototype
Size
Tiny · ≤0.05 GB
Formats
JSON, CSV
Access
API or Download
API key
Not required
Provider
Forum of Incident Response and Security Teams
Updates
Daily
Data terms
FIRST EPSS Usage Agreement

From source to product signal

Test a product idea in four steps

EPSS estimates the probability that a published CVE will be exploited in the next 30 days. Start with one CVE and the current daily score. EPSS is a likelihood model, not proof of exploitation, and it does not replace asset exposure or CISA Known Exploited Vulnerabilities evidence.

1

Check the setup

  • Python 3.10 or newer
  • A notebook environment such as Jupyter or Google Colab
  • An internet connection
2

Access the data

  1. 1.Read the EPSS FAQ, including the request to attribute FIRST when scores appear in a product.
  2. 2.Request the current score for one CVE from the public API.
  3. 3.Keep the CVE identifier, EPSS score, percentile, and retrieval time.
Open official source
3

Run the Python example

Install the packages, then run the notebook cell.

python -m pip install pandas requests

import pandas as pd
import requests

response = requests.get(
    "https://api.first.org/data/v1/epss",
    params={"cve": "CVE-2024-3400"},
    timeout=30,
)
response.raise_for_status()
scores = pd.DataFrame(response.json()["data"])
scores["retrieved_at_utc"] = pd.Timestamp.now(tz="UTC")
print(scores[["cve", "epss", "percentile", "date"]].head())
4

Test a useful signal

Compare one CVE's exploit probability with its KEV status

Test whether EPSS can rank a published CVE before treating it as an active incident.

  1. 01Retrieve the current EPSS score and percentile for CVE-2024-3400.
  2. 02Record whether the same CVE appears on an authorized Known Exploited Vulnerabilities list.
  3. 03Explain why a high EPSS score is not the same as confirmed exploitation or organizational exposure.

Dataset details

Forum of Incident Response and Security Teams is a nonprofit source. Last verified 2026-08-18. Temporal coverage: 2021-present.

Theme

Technology & Cybersecurity

Domains

CybersecuritySoftware Security

Data types

ScoresEvent Data

Tasks

Vulnerability MonitoringRisk AssessmentAlerting

Geography

Global

Formats

JSONCSV

Provider

Forum of Incident Response and Security Teams

Data terms

FIRST EPSS Usage Agreement