EOL Risk Score vs EPSS vs CISA KEV: What Each One Tells You
EPSS estimates the probability that a published CVE will be exploited in the wild in the next 30 days. CISA's KEV catalog lists CVEs that have already been exploited. The EOL Risk Score rates a software version, from 0 to 100, on how risky it is to keep running given its lifecycle state. The first two are about individual vulnerabilities. The third is about the software those vulnerabilities live in, and it uses KEV as one of its four factors.
Side by side
| EPSS | CISA KEV | EOL Risk Score | |
|---|---|---|---|
| What is rated | One CVE | One CVE | One version of one product |
| What it says | How likely exploitation is in the next 30 days | CISA has added the CVE to its catalog of vulnerabilities known to be exploited in the wild | How risky the version is to keep running |
| Form | A probability from 0 to 1, with a percentile rank | A list: a CVE is on it or not, with a date added and a due date for US federal agencies | A 0 to 100 score, grouped into four risk bands, with its four contributing factors shown |
| Updated | Recalculated daily for every CVE. The model itself is revised from time to time; FIRST put version 5 live in June 2026 | As CISA adds entries | At every build, as dates pass and KEV changes |
| Knows whether the version is still supported | No | No | Yes, it is the largest factor |
| Published by | FIRST | CISA | endoflife.ai |
EPSS details are from FIRST's EPSS pages; the catalog is CISA's Known Exploited Vulnerabilities catalog. The EOL Risk Score method is on the Risk Score page.
How the EOL Risk Score uses KEV
CISA KEV exposure is worth up to 20 of the 100 points. The score does not count CVEs and does not use EPSS or CVSS values. The KEV factor asks a product-level question: is the product behind the scored version named in CISA's catalog (20 points), or is a core component it ships named there, as the Linux kernel is for Linux distributions (10 points)? A product with neither gets no KEV points. The reasoning is that a product attackers already have working tooling for is a worse thing to leave without fixes. The product sets are derived from CISA's live catalog at every build. The other three factors are end-of-life recency (40 points), attack surface (30) and extended support availability (10).
Using them together
- On supported software, a fix exists and the question is sequence. Organisations can use KEV to identify known exploitation, EPSS to estimate the chance of exploitation in the near term, and CVSS to understand severity and impact. See EOL Risk Score vs CVSS.
- On software at or past end of life, the normal vendor patch route has closed. The EOL Risk Score adds the lifecycle context for deciding which migrations and extended-support purchases come first.
- Where a KEV entry lands on an end-of-life version, there is an exploited flaw with no vendor fix for that version. Those cases are tracked one by one in our Exploited and Unpatchable feed.
Frequently Asked Questions
What is the difference between EPSS, CISA KEV and the EOL Risk Score?
EPSS estimates the probability that a published CVE will be exploited in the wild in the next 30 days. CISA KEV is the catalog of vulnerabilities that CISA has determined are being exploited in the wild. The EOL Risk Score rates the lifecycle risk of a software version, based on how recently it reached end of life, its attack surface, the product's exposure in KEV and whether extended support exists. EPSS and KEV work at the level of a single CVE; the EOL Risk Score works at the level of a software version.
What is the difference between the EOL Risk Score and EPSS?
EPSS scores a CVE: it estimates the probability, from 0 to 1, that a published vulnerability will be exploited in the wild in the next 30 days. The EOL Risk Score scores a software version: it rates, from 0 to 100, how risky that version is to keep running given its lifecycle state. EPSS helps decide which known flaws to fix first. The EOL Risk Score identifies the versions where vendor fixes have stopped.
Does EPSS account for end-of-life software?
EPSS is calculated per CVE and says nothing about whether the affected version still receives fixes. A low EPSS value on a version past end of life still describes a flaw the vendor will not patch there.
Does the EOL Risk Score use EPSS or KEV?
It uses KEV, at product level. A product named in CISA's Known Exploited Vulnerabilities catalog gets 20 of the 100 points, and a product that ships a core component named there gets 10. The score does not count CVEs and does not use EPSS or CVSS values.
Which should I use to prioritise?
All of them, for different decisions. Use KEV and EPSS, with CVSS, to order patching of known CVEs on supported software. Use the EOL Risk Score to order migrations and extended-support decisions for versions at or past end of life, where vendor patching has stopped.