I timed EPSS against CISA on 204 exploited CVEs. It mostly forecasts yesterday's rain – part 2/3 | HBCC

An analysis of vulnerability prioritization pipelines reveals that exploitation probability scores from EPSS frequently arrive too late or stay too low to be useful for day-one triage. The author argues that the exploitation signal acts largely as a forecast of yesterday's rain, often mirroring CISA's Known Exploited Vulnerabilities catalog rather than predicting it in advance. Open article →