What EPSS Actually Measures
A 0–1 probability estimating the likelihood a specific CVE will be exploited in the wild within the next 30 days.
Why It Matters
Most CVEs are never actually exploited — EPSS exists because CVSS alone can't distinguish a theoretically severe vulnerability from one attackers are actively using, and that distinction matters enormously for prioritization under limited engineering time.
Application to Application Security
Most directly useful for dependency and third-party-component CVEs (OWASP M2 territory), where a large backlog of known-CVE findings needs a defensible way to decide what gets patched this sprint versus next quarter.
Relation to Software Development
EPSS is a scoring input a vulnerability management process consumes, not something an application implements — its relevance to development is entirely in how a team prioritizes its remediation backlog.
How Strata Surfaces This
Strata's own coverage focuses on CVSS Base scoring for findings; EPSS is documented here as the complementary exploitation-likelihood signal a mature vulnerability-management process layers on top of severity alone.
Developer guidance
When triaging a large CVE backlog, use EPSS to separate "theoretically bad" from "actively being exploited right now" before deciding what to fix this sprint.
Management guidance
EPSS gives you a defensible, data-driven answer to "why did we fix this Medium-severity finding before that Critical one" when reachability and active exploitation justify it.