I timed EPSS against CISA on 204 exploited CVEs. It mostly forecasts yesterday's rain – part 2/3

Tue, 03 Nov 2026 00:00:00 +0000

Part 1 ended on a claim it could not yet settle: on the day a CVE is published there is almost nothing to rank it by, unless it arrives already loud, so the design problem is asking again on later runs. Ten days was an anecdote. This is the claim measured over longer, and the finding is uncomfortable: the signal the whole architecture leans on, the probability a vulnerability will be exploited, stayed silent.

measurement on HBCC

I timed EPSS against CISA on 204 exploited CVEs. It mostly forecasts yesterday's rain – part 2/3