Despite the massive investments in information security technologies and
research over the past decades, the information security industry is still
immature. In particular, the prioritization of remediation efforts within
vulnerability management programs predominantly relies on a mixture of
subjective expert opinion, severity scores, and incomplete data. Compounding
the need for prioritization is the increase in the number of vulnerabilities
the average enterprise has to remediate. This paper produces the first open,
data-driven framework for assessing vulnerability threat, that is, the
probability that a vulnerability will be exploited in the wild within the first
twelve months after public disclosure. This scoring system has been designed to
be simple enough to be implemented by practitioners without specialized tools
or software, yet provides accurate estimates of exploitation. Moreover, the
implementation is flexible enough that it can be updated as more, and better,
data becomes available. We call this system the Exploit Prediction Scoring
System, EPSS.

本文提出了第一个开放的数据驱动的漏洞威胁评估框架，即漏洞在公开披露后的 12 个月内被利用的概率评分系统，该系统被设计为足够简单，可以由非技术专家实践者实现，同时提供准确的利用估计，且可根据更多更好的数据进行更新。我们称之为 Exploit Prediction Scoring System (EPSS)。