What EPSS score is high enough to act on?
There is no universal threshold, but the distribution is extremely skewed: the vast majority of CVEs score below 0.01, so anything above roughly 0.1 already sits in a small minority worth a look, and above 0.5 is a strong signal. Treat EPSS as a ranking tool within your exposed inventory, not as a pass/fail gate.
Because scores are probabilities of exploitation in the next 30 days, they move. A vulnerability published quietly can climb sharply once proof-of-concept code circulates, which is exactly the moment you want to be re-sorted rather than working from a stale list.
The practical pattern is a two-axis filter: EPSS for likelihood, your own asset inventory for exposure. A 0.6 on something not deployed is noise; a 0.2 on your internet-facing edge is not.
Confirmed exploitation always outranks a prediction. If a CVE is in CISA KEV, its EPSS score is no longer the deciding input — the exploitation already happened.