EPSS v4 Update: From Score Clustering to Clearer Risk Metrics

Last week, FIRST released the long-anticipated update to EPSS Version 4—its first major model revision in over two years. This update marks a significant shift in how vulnerabilities are scored and prioritized, with substantial changes in the distribution of scores compared to EPSS v3. Patrick Garrity’s analysis provides a detailed initial look at these shifts and their implications for vulnerability management programs.

The EPSS v4 Update in Focus

The update to EPSS v4 represents a fundamental change in the scoring methodology. By comparing EPSS percentiles across both versions in 10% increments, a notable transformation in score distribution has emerged. Some key findings from the comparison include:

Wide Variance in Score Shifts:
- A significant number of vulnerabilities (CVEs) have moved between percentile buckets when transitioning from EPSS v3 to v4.
- For example, only 58.23% of CVEs in the 90+ percentile range remained there in v4, while lower ranges saw even greater shifts.
Resolution of Score Clustering:
- In EPSS v3, the 10% percentile bucket contained an unusually high number of CVEs, largely due to many vulnerabilities sharing identical scores.
- EPSS v4 introduces a broader distribution across the lower percentiles, effectively resolving this clustering issue.
Removal of Rejected CVEs:
- EPSS v4 has opted to remove scoring for rejected CVEs entirely.
- While these vulnerabilities are often considered non-issues, there have been cases—such as the recent re-instated Atlassian vulnerability—where rejected CVEs have been exploited. This removal might create potential blind spots for programs that rely exclusively on EPSS for prioritization.

Below is a summary of the match rates observed between EPSS v3 and v4 across various percentile ranges:

90+ Percentile: 58.23%
80-89.9 Percentile: 27.77%
70-79.9 Percentile: 21.33%
60-69.9 Percentile: 12.57%
50-59.9 Percentile: 19.00%
40-49.9 Percentile: 17.70%
30-39.9 Percentile: 18.09%
20-29.9 Percentile: 19.13%
10-19.9 Percentile: 23.33%
0-9.9 Percentile: 41.46%

These figures highlight that vulnerabilities once considered high risk may now fall into lower brackets—and vice versa—thereby altering the way risk is perceived.

Implications for Vulnerability Management

The redistribution of EPSS scores under version 4 has significant implications:

Changing Thresholds:
Organizations that base their patching or alerting thresholds on fixed score ranges or percentile cutoffs will need to reassess those thresholds. The shifting score distributions mean that vulnerabilities once flagged as high risk might now be categorized differently.

Potential Blind Spots:
With the removal of rejected CVE scoring, there is a risk that some exploited vulnerabilities could be overlooked if they fall into the rejected category. This change emphasizes the importance of not relying solely on a scoring system for comprehensive vulnerability management.

Enhanced Prioritization Accuracy:
The refined scoring mechanism in EPSS v4 offers an opportunity to better align remediation efforts with the actual risk, potentially leading to more efficient resource allocation across vulnerability management programs.

Conclusion

The EPSS v4 update is a pivotal development for the cybersecurity community. By introducing a broader distribution of scores and revising how certain vulnerabilities are treated, this update challenges traditional approaches to vulnerability prioritization. Organizations will need to adapt their strategies and thresholds to leverage these improvements fully, ensuring that remediation efforts are both timely and effective. As further research unfolds, it will be crucial to continuously evaluate how these changes impact overall vulnerability management practices.

Source: LinkedIn Patrick Garrity