--- title: "EPSS probability and percentile for MSP reviews" description: "Read EPSS probability and percentile beside score dates, KEV evidence, severity, and authorized asset context before MSP owners approve review priorities." canonical: "https://scalewithsearch.com/articles/epss-probability-percentile-msp-review" --- ## Site navigation - [Scale With Search](https://scalewithsearch.com/) - Services - Services - [AI systems](https://scalewithsearch.com/ai-systems) - [Site build](https://scalewithsearch.com/work#site-build) - [Whole website fix](https://scalewithsearch.com/work#whole-website-fix) - [Content library with SEO](https://scalewithsearch.com/work#content-library) - [Working session](https://scalewithsearch.com/audit) - Start here - [Send your brief](https://scalewithsearch.com/work#send-your-brief) - [Example scope](https://scalewithsearch.com/work#review-the-example-scope) - [Prices and terms](https://scalewithsearch.com/work#prices-and-terms) - Industries - Real estate - [Real estate agents and teams](https://scalewithsearch.com/for/real-estate) - [Platforms, ownership, and IDX](https://scalewithsearch.com/for/real-estate/real-estate-website-platforms-ownership-idx) - [Search, content, and AI](https://scalewithsearch.com/for/real-estate/real-estate-search-content-ai) - [Inquiries, campaigns, and handoffs](https://scalewithsearch.com/for/real-estate/real-estate-website-inquiries-campaigns-handoffs) - [Buyer, seller, and local pages](https://scalewithsearch.com/for/real-estate/real-estate-buyer-seller-local-resources) - [Rules, privacy, and trust](https://scalewithsearch.com/for/real-estate/real-estate-website-rules-privacy-trust) - Browse by business - [Trades and home services](https://scalewithsearch.com/for/#group-trades) - [Health, wellness, and animal care](https://scalewithsearch.com/for/#group-practices) - [Law, finance, and IT](https://scalewithsearch.com/for/#group-professional) - [Marketing and SEO agencies](https://scalewithsearch.com/for/#group-agencies) - [Shops and manufacturers](https://scalewithsearch.com/for/#group-manufacturing) - [Restaurants, shops, studios, and nonprofits](https://scalewithsearch.com/for/#group-local-services) - Chiropractic practices - [Chiropractic and wellness practices](https://scalewithsearch.com/for/chiropractic-and-wellness-practices) - [Chiropractic and physical therapy clinics](https://scalewithsearch.com/for/chiropractic-and-physical-therapy-clinics) - [All industries](https://scalewithsearch.com/for/) - Resources - Free tools - [AI readiness check](https://scalewithsearch.com/check) - [Free tools](https://scalewithsearch.com/tools/) - [Free Starter Kit](https://scalewithsearch.com/kit/business-memory-starter-kit.zip) - Guides - [AI-native library](https://scalewithsearch.com/ai-native) - [Industry intelligence](https://scalewithsearch.com/intelligence) - [Office job guides](https://scalewithsearch.com/guides/) - [Business memory](https://scalewithsearch.com/articles/business-memory-for-ai-agents-guide) - [Agent governance](https://scalewithsearch.com/articles/ai-agent-governance-guide-small-business) - [Migration and ownership](https://scalewithsearch.com/articles/leaving-vendor-ai-memory-guide) - Articles - [All articles](https://scalewithsearch.com/articles/) - [What changed](https://scalewithsearch.com/changes/) - About - Evidence - [Proof](https://scalewithsearch.com/proof) - Scale With Search - [About](https://scalewithsearch.com/about) - [How it works](https://scalewithsearch.com/how-it-works) # EPSS probability and percentile: read two different numbers in an MSP review A managed service provider (MSP) service lead must explain why a vulnerability needs a particular review task. A probability and a percentile answer different questions. Preserve both labels, their score date, and the local evidence before presenting a queue to its owner. FIRST's Exploit Prediction Scoring System, or EPSS, estimates whether exploitation activity for a vulnerability will be observed across its data partners. The prediction covers the next 30 days. Its probability ranges from zero to one. Percentile expresses relative position among scored vulnerabilities. [FIRST EPSS FAQ](https://www.first.org/epss/faq). This guide proposes a private review worksheet for authorized customer records. All numerical examples are fictional. It supplies no live scores, patch threshold, customer breach probability, or permission to delay action. The [MSP intelligence overview](/intelligence/it-and-managed-service-providers) introduces the broader preparation task. Start here when a service lead needs precise language for two numbers in the same review. ## Give probability and percentile separate labels Display a fictional probability of `0.08` as 8%. Display a fictional percentile of `0.96` as the 96th percentile. Keep the original decimal values available beside those displays. In the synthetic example, 8% describes the estimate for observed exploitation activity over the stated horizon. The 96th percentile describes the score's relative position. It does not turn the probability into 96%. FIRST's data guidance defines percentile as the proportion of scored vulnerabilities with the same score or lower. Its published data uses distinct `cve`, `epss`, and `percentile` fields. [FIRST Get the Data](https://www.first.org/epss/data.html). Use explicit column headings in the worksheet. Avoid “EPSS percentage” as a heading that could hold either value. Ask a reviewer to read both numbers aloud before approving a summary. Do not use a school-grade metaphor such as “96% dangerous.” Instead, write the two meanings in full. That sentence can travel with the record when another person reads it outside the original meeting. ## Keep the date attached to the estimate FIRST publishes EPSS scores daily. Its data guidance describes dated historical lookups and daily score files. Preserve the score's publication date separately from your retrieval time. [FIRST data access guidance](https://www.first.org/epss/data.html). Add a review meeting date as a third field. These dates support different questions: which estimate was retrieved, when it was retrieved, and when someone considered it. If a report arrives without a score date, mark the estimate's date unknown. Do not insert the download date as though it were the source date. Assign a source-check task before presenting the number as current. Keep the prediction horizon visible beside the score date. FIRST's FAQ describes a forward-looking 30-day estimate. A later copy of an older row does not create a new prediction window. [FIRST EPSS FAQ](https://www.first.org/epss/faq). For your own record, retain the exact response or file reference that supported the displayed value. If the source cannot be reproduced, record that limitation. A screenshot of an unlabeled percentage is insufficient for this proposed worksheet. ## Read a fictional two-row review Suppose a service lead prepares two synthetic vulnerability entries, Example A and Example B. Neither label identifies a real CVE. The values below are invented teaching values, not current distribution claims. | Synthetic field | Example A | Example B | | --- | --- | --- | | EPSS probability | 0.08, displayed as 8% | 0.01, displayed as 1% | | EPSS percentile | 0.96, displayed as 96th | 0.75, displayed as 75th | | Score date | October 20, 2026 | October 20, 2026 | | KEV evidence | Not checked | Fictional confirmed listing | | Local applicability | Version comparison complete | Version evidence unresolved | | Proposed review task | Owner reads complete applicability packet | Technician resolves version evidence | Read Example A as a dated estimate with a relative ranking. Do not tell the customer that 96% of its assets will be attacked. The worksheet contains no basis for that statement. For Example B, keep the fictional confirmed listing visible beside the smaller prediction. Ask the responsible lead to apply the established escalation process. The score does not erase the evidence or finish the missing version check. These proposed tasks illustrate evidence preparation. Their order does not establish a universal priority between two real vulnerabilities. The service owner must consider the actual sources, applicable obligations, and customer context. In a meeting, ask the lead to explain what remains unknown in each row. Example A still needs a decision under the customer's process. Example B needs local evidence as well as the required escalation review. ## Keep KEV evidence and severity independent FIRST distinguishes KEV's confirmed exploitation evidence from EPSS's forward-looking estimate. Its guidance says confirmed exploitation should take precedence when present. It also warns against treating a low score as safe to ignore. [FIRST Using EPSS](https://www.first.org/epss/using-epss). Use one field for the KEV check result and another for its dated source. Record “not checked” when no check occurred. Reserve “not found in the reviewed catalog” for a completed comparison against an identified release. Keep severity in a separate field with its own source. FIRST's CVSS user guide describes the Common Vulnerability Scoring System as communicating vulnerability characteristics and severity. [CVSS v4.0 User Guide, document version 1.2](https://www.first.org/cvss/v4.0/user-guide). If the source includes a severity score, retain its version, vector, and attribution with the record. Do not replace that detail with an unlabeled number in a merged score column. For this worksheet, do not multiply severity by EPSS to create a customer risk percentage. FIRST warns against multiplying EPSS by an ordinal score and calling the product risk. [FIRST guidance on misuse](https://www.first.org/epss/using-epss). The preparation task is to preserve interpretable inputs. Leave the response decision to the named owner under the customer's established rules. ## Reject an unlabeled percentage Consider a second synthetic handoff. A technician receives a row containing “EPSS: 97%,” a product name, and a customer abbreviation. No original field names, score date, or CVE reference accompany it. Reject the row as a basis for a numerical claim. Ask whether 97% represents a probability, a percentile display, or a transcription error. Preserve the received wording while the source is checked. Do not repair the row by choosing the interpretation that seems plausible. Leave both numerical fields unresolved. Assign a source lookup to the reviewer who owns the vulnerability reference. Keep the customer record inside its approved tenant boundary during that lookup. Use the public vulnerability identifier for public source research. There is no need to place customer names or private asset details into a public request. When the source returns, record the corrected field labels and date. Keep a short correction note explaining the earlier ambiguity. Ask the owner to reconsider any draft queue that relied on the unlabeled number. ## Handle missing scores without inventing zero Distinguish a successful lookup with no returned row from an access failure or an unreadable file. Give each condition its own status. Store the request date and checked vulnerability identifier beside that status. If no score can be established, use “unavailable” in the display. Keep the numerical cell empty. Do not insert zero to make a spreadsheet formula or sort order work. Treat missing percentile and missing probability as separate defects when only one field is present. Preserve whichever source value can be verified. State which interpretation remains incomplete. A last verified value may remain useful as history. Label it with its original date and the failed refresh. Do not silently carry it forward as today's score. Keep review work open under the customer's existing process while the source issue is resolved. An unavailable prediction does not remove confirmed evidence, local findings, or applicable obligations from the packet. ## Compare changed dates without rewriting history Suppose the synthetic Example A has probability `0.08` on one score date and `0.03` on a later date. Store two observations. Keep each date's percentile beside its own probability. Do not combine the earlier percentile with the later probability. Do not describe the difference as a measured reduction in customer breach probability. The worksheet has supplied no customer-specific probability calculation. FIRST's FAQ explains that scores can change as information changes. It does not let a service lead infer the cause of a particular movement without checking evidence. [FIRST EPSS FAQ](https://www.first.org/epss/faq). For the local review, ask what changed in the evidence packet. Was a version confirmed? Did an advisory revision appear? Did the asset owner supply a corrected record? Record actual changes instead of inventing a story from two numbers. Preserve the decision made with each observation. A later review should be able to reconstruct what the earlier owner saw. Keep the correction and the source reference together. ## Prepare an owner-readable worksheet Use one private worksheet per tenant review. Link repeated public CVE evidence by reference, while keeping customer asset evidence separate. The following is a proposed template, not a FIRST requirement. | Field | Required meaning in this template | Owner's question | | --- | --- | --- | | Vulnerability reference | Exact checked CVE identifier | Are all public inputs about the same issue? | | Probability | Verified decimal and percentage display | What does the estimate say? | | Percentile | Verified decimal and percentile display | What relative position is reported? | | Score date and horizon | Source date and stated prediction window | Which prediction are we reading? | | Retrieval status | Retrieved, unavailable, failed, or incomplete | Is there usable evidence? | | KEV evidence | Checked release, result, and reference | What confirmed exploitation evidence was reviewed? | | Severity | Source, version, score and vector if supplied | Which severity assessment is recorded? | | Local applicability | Tenant, asset, product and version evidence | Does the issue apply to this recorded installation? | | Local context | Approved reachability and impact evidence | What is established about this environment? | | Owner decision | Named reviewer, reason, and review date | Which review task is authorized next? | FIRST's use guidance identifies presence, reachability, and consequence as local context needed alongside the population-level score. EPSS itself does not know your inventory or controls. [FIRST local-context guidance](https://www.first.org/epss/using-epss). Use the sibling [KEV product-match worksheet](/articles/cisa-kev-product-match-msp-asset-review) to prepare applicability evidence. Keep an unresolved product candidate visible until its technician checks the version. ## Hand the queue to its decision owner Ask the owner to approve a review task and record its reason. Name the evidence still needed, the responsible technician, and the next internal review target. Label that target as internal. Keep patch policy, production changes, customer messages, and incident decisions in their existing approval processes. This worksheet prepares the evidence those processes need. It does not grant execution access. Retain accepted corrections in the team's working instructions. The [business memory guide](/articles/business-memory-for-ai-agents-guide) explains keeping those decisions in business-owned records. Here, preserve field definitions, source dates, and rejected interpretations. The [MSP service overview](/for/it-and-managed-service-providers) describes preparation from authorized records. Scale With Search can scope the source fields, private boundaries, review roles, and acceptance checks for a repeatable worksheet. [Send your brief](/work) ## Sources and limits FIRST's EPSS FAQ, Using EPSS, and Get the Data pages were reopened on October 28, 2026. The CVSS reference is user guide document version 1.2. The [official CISA repository](https://github.com/cisagov/kev-data) was also reopened. All probabilities, percentiles, dates in worked examples, and customer circumstances are synthetic. No live score or customer compromise probability was calculated. Reopen the current documentation and the relevant source observation before using the worksheet for an actual review. Continue the website review: [AI-native IT providers: the first functions to build](/articles/ai-native-managed-service-providers-first-functions); [CISA KEV product matches: prepare an MSP asset review without declaring exposure](/articles/cisa-kev-product-match-msp-asset-review); [E-Rate allowable contract dates: distinguish the waiting period from the bid deadline](/articles/erate-allowable-contract-date-bid-deadline); [E-Rate Form 470 changes: keep the current RFP in your bid review](/articles/erate-form-470-rfp-amendment-review); [Managed IT pricing pages: explain what sets the quote](/articles/managed-it-pricing-website-page); [MSP AI rules: data, approvals, and spend](/articles/msp-ai-rules-data-approvals-spend); [MSP case studies: publish evidence without client names](/articles/msp-anonymous-case-study-website); [MSP onboarding pages: explain the first steps](/articles/msp-client-onboarding-website-page); [MSP contact form spam: inspect the receiving path](/articles/msp-contact-form-spam-controls); [MSP cybersecurity website claims: show the scope](/articles/msp-cybersecurity-website-claims); [Google Business Profile for an MSP: check eligibility](/articles/msp-google-business-profile-eligibility); [MSP service area pages: separate on-site and remote](/articles/msp-onsite-service-area-website-pages); [MSP status pages: publish approved incident updates](/articles/msp-public-status-page-website); [MSP buyer guides: make the download useful](/articles/msp-website-buyer-guide-download); [MSP inquiry emails missing: trace the delivery steps](/articles/msp-website-inquiry-email-not-arriving); [MSP website design: separate sales from support](/articles/msp-website-sales-and-support-paths); [Discontinued AV equipment: read Q-SYS service terms before recommending replacement](/articles/qsys-discontinued-equipment-service-terms-review); [Q-SYS compatibility tables: review installed hardware before a software change](/articles/qsys-hardware-software-compatibility-table-review). [IT and managed service providers](/for/it-and-managed-service-providers): website and search resources. ## Related: IT and managed service providers - [E-Rate allowable contract dates: distinguish the waiting period from the bid deadline](/articles/erate-allowable-contract-date-bid-deadline) - [E-Rate Form 470 changes: keep the current RFP in your bid review](/articles/erate-form-470-rfp-amendment-review) - [Managed IT pricing pages: explain what sets the quote](/articles/managed-it-pricing-website-page) ---- ```text .|########||. .|########||. .|########||. |##||. .||##|. |##||. .||##|. |##||. .||##|. |#|. .|#|. |#|. .|#|. |#|. .|#|. |#| |#| |#| |#| |#| |#| .#| |#. .#| |#. .#| |#. .#. .#| .#. .#| .#. .#| |#. .#| |#. .#| |#. .#| |# ...... #| |# ...... #| |# ...... #| .# ||#########| #| .# ||#########| #| .# ||#########| #| .#. |######||######|. .#. .#. |######||######|. .#. .#. |######||######|. .#. #. .##|###|##|#|######| .# #. .##|###|##|#|######| .# #. .##|###|##|#|######| .# || |##|#||||||||||||#||#| || || |##|#||||||||||||#||#| || || |##|#||||||||||||#||#| || # |#||||||||||||||||||||#| #. # |#||||||||||||||||||||#| #. # |#||||||||||||||||||||#| #. || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || # .#||||||||||||||||||||||||#| # # .#||||||||||||||||||||||||#| # # .#||||||||||||||||||||||||#| # || ....|||#||||||##|#|||#|#||##||||....|. || || ....|||#||||||##|#|||#|#||##||||....|. || || ....|||#||||||##|#|||#|#||##||||....|. || #. . ....|# ....#||| ||| .#||| ....#. .# #. . ....|# ....#||| ||| .#||| ....#. .# #. . ....|# ....#||| ||| .#||| ....#. .# # . ||||#| .#####|| . .#| .#||| ||||# #. # . ||||#| .#####|| . .#| .#||| ||||# #. # . ||||#| .#####|| . .#| .#||| ||||# #. .| ||||| #. |#|||||. || #. |#||. .||||| || .| ||||| #. |#|||||. || #. |#||. .||||| || .| ||||| #. |#|||||. || #. |#||. .||||| || || |.... #. ....|#. |. ...|. ....|| || || |.... #. ....|#. |. ...|. ....|| || || |.... #. ....|#. |. ...|. ....|| || #. .||||||##||||||##||####|||||||#||||||#| .# #. .||||||##||||||##||####|||||||#||||||#| .# #. .||||||##||||||##||####|||||||#||||||#| .# # .||####|###########################|. # # .||####|###########################|. # # .||####|###########################|. # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#||||||############|######|||||#| # # .#||||||############|######|||||#| # # .#||||||############|######|||||#| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# || | ...|| ...##| | #| .|. |. ##### .. .| || || | ...|| ...##| | #| .|. |. ##### .. .| || || | ...|| ...##| | #| .|. |. ##### .. .| || || ||||| || ||||#| . |. |. |#. ||||| |#| || || || ||||| || ||||#| . |. |. |#. ||||| |#| || || || ||||| || ||||#| . |. |. |#. ||||| |#| || || .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. #.|||||||#############################| ||| .# #.|||||||#############################| ||| .# #.|||||||#############################| ||| .# || ##||#||#||||||#||#||#||#||##. || || ##||#||#||||||#||#||#||#||##. || || ##||#||#||||||#||#||#||#||##. || # .#|||||||||#||#|||||||||||#| # # .#|||||||||#||#|||||||||||#| # # .#|||||||||#||#|||||||||||#| # || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || .# |#||||||||||||||||||||#| #. .# |#||||||||||||||||||||#| #. .# |#||||||||||||||||||||#| #. || |#||||||||||||||||||#| || || |#||||||||||||||||||#| || || |#||||||||||||||||||#| || #. .######|#|#########| .# #. .######|#|#########| .# #. .######|#|#########| .# .#. |#####||||#####| .#. .#. |#####||||#####| .#. .#. |#####||||#####| .#. |# ||########|| #. |# ||########|| #. |# ||########|| #. |# ...... #| |# ...... #| |# ...... #| |#. .#| |#. .#| |#. .#| |#. .#. |#. .#. |#. .#. .#| |#. .#| |#. .#| |#. |#| |#| |#| |#| |#| |#| .|#|. .|#|. .|#|. .|#|. .|#|. .|#|. |##||. .||##| |##||. .||##| |##||. .||##| .||########||. .||########||. .||########||. Scale With Search 2026 [scalewithsearch.com](https://scalewithsearch.com) ```