Skip to main content
Skip table of contents

View EPSS Scores for Container Images

Overview

EPSS (Exploit Prediction Scoring System) is an open effort that uses current threat information from CVE and real-world exploit data to estimate the probability that a given vulnerability will be exploited in the wild.

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability can be exploited.

Use cases for EPSS scores

EPSS scores within the Mend Application can be utilized in the following ways:

  • You, an AppSec Manager, are responsible for overseeing your organization's security posture, including the security of container images. You need a way to prioritize the most critical security risks first.

  • You, a Security Champion, are responsible for assisting management with prioritizing vulnerabilities. You need data to triage the vulnerabilities that your team should address right away.

Mend’s Answer: In the Mend Application, the EPSS score for vulnerabilities is a powerful tool for prioritizing remediations of the Mend CLI scan findings for container images.

Getting it done

You can view the EPSS scores of your container image scans within the Mend Application via the following views:

  • Images dashboard → Vulnerabilities tab

  • Vulnerabilities dashboard

Images dashboard

View the EPSS scores of each scanned container image in the Images dashboard:

  1. Select a container image.

  2. Click the Vulnerabilities tab.

  3. The EPSS score column is listed in the Vulnerabilities data table.

    1. Vulnerabilities can be sorted by EPSS score.

Vulnerabilities dashboard

View your organization’s EPSS scores in the Vulnerabilities dashboard:

  1. Navigate to the Vulnerabilities dashboard.

  2. The EPSS score column is listed within the dashboard’s data table.

The data within the Vulnerabilities dashboard can be filtered by EPSS Score:

  • 0-0.1: 0% - 10% EPSS Score

  • 0.1-0.5: 10% - 50% EPSS Score

  • 0.5-1: 50% - 100% EPSS Score

Reference

Understand EPSS and its background

EPSS is a relatively recent effort to make remediation suggestions more efficient. EPSS uses machine learning that inputs more than a thousand variables, including reports from the wild, to generate a score. Details of the EPSS method are given here.

CVSS 3 scores represent the vulnerability itself and range from zero to ten in decimals (0.0 - 10.0). EPSS scores represent the probability risk of exploitation and range from zero to one in percentages (0.02 = 2%, 0.6 = 60%, 1 = 100%).

Container Image Risk Score - EPSS and CVSS 3

Our weighted risk score for each scanned container image considers both EPSS and CVSS v3 scores when formulated:

For more information about CVSS Types, review our Vulnerabilities – Risk Scoring documentation.

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.