VULNpocalypse

VEDAS vs EPSS: which score sees the attacks coming?

We checked both scores against 183 bugs attackers went on to use. Patch the top 35% by VEDAS and you had already covered 90% of them; by EPSS, 53%.

Generated by VEDAS. Scores as of 2026-11-01 19:19 UTC. Rebuilt every few hours from cve-scores, CISA KEV and vedas-signatures. How this works and its limits.

VEDAS sees the attacks EPSS misses

Patch the top 35% of CVEs by each score. How many of the 183 bugs CISA later confirmed under attack would you already have covered? VEDAS: 90%. EPSS: 53%.

VEDAS

90%

of the bugs attackers went on to use were already in the top 35% of CVEs by VEDAS, before CISA confirmed the attacks.

EPSS

53%

for the top 35% by EPSS, the industry’s standard exploit forecast. Same patching effort, 37 points fewer attacks covered.

VEDASEPSSpatching at random
0%25%50%75%100%0%10%20%30%40%50%60%share of all CVEs you patchRandom patchingrandomWhere VEDAS covers more attacks for the same patchingEPSSEPSS 63%VEDASVEDAS 93%VEDAS 90% at 35%EPSS 53% at 35%VEDAS 90%EPSS 53%
Source: cve-scores weekly history since 2025-04-13 · CISA KEVVULNPOCALYPSE.DEV
How to read it
Each line shows what share of later-attacked bugs you cover (up) as you patch more of all CVEs (right). Higher is better. The shaded area is where VEDAS covers more for the same effort, from about the top 24% of CVEs onward. The grey line is patching at random. At the very top EPSS is sharper: in the top 10%, EPSS covered 43% and VEDAS 7%. VEDAS pulls ahead once you aim to catch most attacks.
How this is calculated
For every bug CISA added to its Known Exploited Vulnerabilities list after 2025-04-13, we take its EPSS and VEDAS from the last cve-scores snapshot before the listing, so neither score gets credit for reacting to CISA. A bug only counts if that snapshot is at most 7 days old: cve-scores published almost daily until 22 February 2026, paused until 8 August 2026, and was irregular after, so 62 bugs listed during the pause were left out. Patching effort is the share of all 477,329 CVEs at or above the same score today. A CVE with no EPSS score cannot be flagged by EPSS.

No score means no warning

13 of 183

attacked bugs had no EPSS score at all before CISA listed them

VEDAS had scored every one of them.

1,728

CVEs from 2026 have no EPSS score today

VEDAS scores all 84,067 of them, from the day they appear.

What each score is

  • EPSS (FIRST.org) predicts the chance a CVE will be attacked in the next 30 days. It covers CVEs only, and only once FIRST has scored them.
  • VEDAS (A.R.P. Syndicate) measures how much evidence of working exploits exists and how widely a bug shows up, across more than 150 vulnerability ID systems, not just CVE. Scores are public in cve-scores and refresh every 6 to 8 hours.

How to use them together

EPSS is a good short list: if you can only patch a few thousand CVEs, its very top picks are sharp. VEDAS is the safety net: once you need to cover most attacks, it gets there with far less work, and it scores the CVEs EPSS has not reached yet. On this data, patching the top 24% to 35% by VEDAS covers more attacks than the same effort spent on EPSS.

Check our work

Everything here is reproducible from public data: the cve-scores commit history and CISA’s KEV catalogue. We judge each bug by its scores before CISA listed it, because both scores take CISA’s list into account afterwards.