I timed EPSS against CISA on 204 exploited CVEs. It mostly forecasts yesterday's rain – part 2/3

Tue, 03 Nov 2026 00:00:00 +0000

Part 1 ended on a claim it could not yet settle: on the day a CVE is published there is almost nothing to rank it by, unless it arrives already loud, so the design problem is asking again on later runs. Ten days was an anecdote. This is the claim measured over longer, and the finding is uncomfortable: the signal the whole architecture leans on, the probability a vulnerability will be exploited, stayed silent.

A CVE triage pipeline that keeps asking, because day one tells you nothing

Sat, 31 Oct 2026 00:00:00 +0000

The pipeline is called Rappaport, after a scientist in Lem’s His Master’s Voice, a novel in which a team of researchers reads meaning into a signal from the stars and slowly learns that the meaning tells them more about themselves than about the signal. That is the failure I kept meeting in the field. A detection stack returns a confident verdict, and the confidence comes from how little it has seen. When partial signal can corrupt the verdict, priority cannot be read off whatever a record claims about its own severity. It has to be computed from signal that actually predicts exploitation, before anything a model could be talked into gets near it.

python on HBCC

I timed EPSS against CISA on 204 exploited CVEs. It mostly forecasts yesterday's rain – part 2/3

A CVE triage pipeline that keeps asking, because day one tells you nothing