Anthropic Bets on EPSS for the Coming Bug Surge

Why It Matters

EPSS provides a scalable, data‑driven method to triage exploding vulnerability volumes, helping organizations allocate limited patching resources and reduce breach risk. Its growing adoption signals a shift toward predictive, machine‑learning defenses in a rapidly evolving threat landscape.

Key Takeaways

• Anthropic's Mythos accelerates vulnerability discovery, overwhelming traditional programs
• EPSS recommended to prioritize patches by exploiting probability
• EPSS already integrated into 120+ security products
• NIST scaling back CVSS enrichment due to overload; EPSS offers machine‑driven scores
• Experts warn EPSS may lag as exploit times drop to minutes

Pulse Analysis

The rise of AI‑driven vulnerability scanners like Anthropic’s Mythos is reshaping the cyber‑risk landscape. By automatically probing codebases and applications, Mythos can uncover flaws faster than human analysts, flooding security teams with a torrent of new CVEs. This acceleration compounds an already strained vulnerability management process, where organizations struggle to keep pace with patch cycles and prioritize the most dangerous exposures. The shift underscores the need for automated triage mechanisms that can cut through the noise and focus limited resources on real threats.

Enter the Exploit Prediction Scoring System (EPSS), a probabilistic model that estimates the likelihood a vulnerability will be exploited in the next 30 days. Developed by Empirical Security and published through FIRST, EPSS has been adopted by more than 120 security vendors, including CrowdStrike, Cisco, and Palo Alto Networks. By pairing EPSS scores with the CISA Known Exploited Vulnerabilities (KEV) list, defenders can create a manageable patch queue: first remediate KEV items, then address any CVE whose EPSS exceeds a chosen threshold. This approach offers a data‑driven alternative to the traditional CVSS rating, which relies on human‑generated severity scores and is currently being scaled back by NIST due to analyst overload.

Looking ahead, experts caution that EPSS may struggle to keep up as exploit windows shrink from years to minutes. The rapid discovery of non‑CVE flaws—potentially millions of them—will demand real‑time, application‑specific predictive models beyond the current EPSS framework. Building localized machine‑learning models for cloud configurations, container images, and legacy systems could provide the granularity needed for true exposure management. While the volume of AI‑generated vulnerabilities may seem daunting, a layered strategy that combines EPSS, automated patching, and next‑generation predictive analytics can keep enterprises ahead of the accelerating threat curve.