Why CVSS Scores Cluster Around 7

▶ Watch (02:23)

CVSS 3.1 covers 70-80% of 2025 CVEs and has a structural gravity problem. The math pulls almost every vulnerability toward the 7.x band. Beardsley plotted a 76-day window, a one-year window, and a five-year window of published scores. All three produce the same shape: a spike around 7.2 to 7.8, a sharp drop at the extremes.

“CVSS is super good at measuring itself.”

That shape pictures how CVSS is calibrated, not how threats are distributed. If your job is risk reduction rather than regulation compliance, read the vector and skip the number. Network-accessible, no-authentication bugs are worth acting on first, whatever digit the formula produces.

What EPSS Actually Measures

▶ Watch (13:50)

EPSS, an FIRST project since 2021, outputs a daily probability: the chance a given CVE gets exploited somewhere on Earth in the next 30 days. It pulls CVE metadata, CVSS vectors, KEV membership, and keyword signals alongside honeypot hits, IDS alerts, and commercial feeds from Shodan, Censys, GreyNoise, and Shadow Server. No analyst tweaks the knobs.

Running the math across current EPSS scores puts about 10,000 unique CVEs in the likely-exploited-this-month bucket. CISA’s KEV holds roughly 1,400 confirmed entries since launch; Vulncheck KEV reaches about 3,500. That gap is the question EPSS was built to ask.

EPSS Score Volatility and Reading the Signals

▶ Watch (18:28)

CVE-2025-2010, a SQL injection in a WordPress job-board plugin, sat near 0% for weeks. On July 13th its score jumped to 38%. The trigger: someone published a Nuclei template the night before. Metasploit module releases produce the same spike. A 2002-era IKE username-leak CVE bounces unpredictably because every IDS and firewall has a signature for it and fires constantly.

Beardsley’s team at runZero released EPSS Pulse, a free ungated daily dashboard, to track these movements. Setting a 50% jump threshold filters the noise to one or two events every two or three days, a workable morning triage queue.

SSVC and the Limits of Every Scoring System

▶ Watch (22:47)

SSVC is a decision tree from CISA and the Software Engineering Institute. It asks five questions: is exploitation active or a PoC available, does the exploit need user help, what is the technical impact, how important is the target, and do people die if this blows up? CISA’s ATP team already fills in exploitation evidence and technical impact for CVE-identified bugs. Filtering for known PoC and high technical impact returns about 430 CVEs.

No scoring system predicts human intent. Colleagues who flag bad bugs early, before the worldwide event, are worth more than any model. KEV lists are a lagging signal.

Notable Quotes

CVSS is super good at measuring itself. Tod Beardsley · ▶ 9:40

time is linear and for a reason. Tod Beardsley · ▶ 29:07

Key Takeaways

  • CVSS vectors reveal more than scores; network-accessible, no-auth bugs deserve triage priority regardless of the final number.
  • EPSS predicts exploitation activity, not breach events; a Nuclei template publish can push a score from 0% to 38% overnight.
  • SSVC cuts the CVE pile to roughly 430 act-worthy bugs by asking five context-specific questions, but only works if you know your environment.