EPSS is not foolproof: Shift your AppSec beyond vulnerabilities
This Security Boulevard article from March 18, 2025, argues that EPSS scores are not enough and organizations must look beyond vulnerability remediation to manage software cyber-risk. Casey Ellis of Bugcrowd says machine learning ranks known threats well but struggles to predict unknown exploits, and advises prioritizing CISA KEV entries and asset criticality.
Source description, as published
A new study adds force to the argument that organizations need to look beyond vulnerability remediation when it comes to managing and mitigating software cyber-risk.
Inventors / authors: Jai Vijayan