A Visual Exploration of Exploitation in the Wild
Partner: FIRST | Tenable | JupiterOne | Nucleus | Softrams | Vulcan | KYND | AppSalute | FOSSA | ACDS | Edgescan
This first study of EPSS data and performance asks what “exploited in the wild” really means and how well EPSS predictions have held up in hindsight. Half of all exploited vulnerabilities are seen at no more than 0.02% of organizations, and only a small fraction reach more than 1 in 10. The analysis draws on more than 8.6 million daily observations of exploitation activity.
The label “exploited” tends to get treated as a permanent yes-or-no trait, but exploitation varies a great deal in timing and reach. A large share of current activity targets vulnerabilities that are years old, and some exploitation goes quiet for months, so knowing that a CVE has been exploited somewhere says little about whether it threatens a given organization right now. On prediction, CVSS scores correlate only weakly with exploitation, while the KEV is efficient but limited in scope. EPSS does better across the range of scores, and the right threshold depends on how an organization wants to trade coverage against effort.
The full report charts time to first exploitation, time since last exploitation, the age of targeted CVEs and how widely exploitation spreads. It lays out a framework for evaluating prioritization, tests CVSS, the KEV, CVE metadata and exploit tools against it, and gives guidance on choosing EPSS thresholds.
Key Findings
- 6% Ever Exploited: 13,807 of 237,687 published CVEs (about 6%) have had observed exploitation activity, a share that has held fairly steady.
- 0.02% Typical Reach: Half of exploited CVEs are never observed at more than 0.02% of organizations, and only 4.5% reach more than 1 in 10.
- 38% Target 10-Year-Old CVEs: 38% of 8.6 million daily exploitation observations targeted vulnerabilities published more than 10 years earlier.
- 70% Within a Year: 70% of exploited CVEs see first exploitation within a year of publication, and 8% are targeted before the CVE is published.
- A Third Go Dormant: In a typical month, 30% to 40% of previously observed exploitation activity goes unseen, though most activity carries over from earlier months.
- EPSS 0.1+ Threshold: Prioritizing CVEs with EPSS scores of 0.1 or higher achieved about 80% coverage at 50% efficiency.
- Nearly 3x CVSS Coverage: At equal effort (about 21% of vulnerabilities), EPSS covered 93% of exploited CVEs versus 37% for CVSS.
Collaborative analysis by Cyentia Institute and FIRST of 237,687 published CVEs and more than 8.6 million daily exploitation observations from EPSS data partners, through May 2024.
Key Risk Insight
Being “exploited in the wild” says little on its own, because most exploited vulnerabilities reach only a tiny share of organizations. Remediation policy based on the probability of exploitation, rather than severity scores alone, can cover far more real risk for the same effort.
Cite this report: FIRST and Cyentia Institute (2024). A Visual Exploration of Exploitation in the Wild. https://www.cyentia.com/publication/epss-study/
CVE publication volume over a rolling 12-month window. More than 30,000 CVEs are now published a year, far more than any team can fix, which is why prioritization matters. 
Unique CVEs with exploitation activity over time; dips mark data collection outages. The number of actively exploited vulnerabilities grows as some drop off and others are newly attacked, so “exploited” is a moving set rather than a fixed list. 
Monthly exploitation activity by whether a CVE was seen before. Newly exploited vulnerabilities get the most attention, but most activity in any month targets CVEs that were already known to be exploited. 
A Visual Exploration of Exploitation in the Wild, the first study of EPSS data and performance. It covers how often vulnerabilities are exploited, how that activity changes over time, and how EPSS compares with CVSS and the KEV.