EMPIRICAL AUDIT OF PRIORITIZATIONS FOR EPSS V4 AND V5 BETA

Abstract

This study examines differences between vulnerability priority lists produced by EPSS v4 and EPSS v5 beta and the limits of evaluating these differences against subsequent additions to the CISA Known Exploited Vulnerabilities catalog. The objective is to relate changes in list composition to later KEV entries while auditing the temporal availability of the score files themselves. The analysis uses all 18 matching dates available in a frozen public beta archive, from 22 May to 8 June 2026. For each date, the eligible population consists of CVEs scored by both versions and absent from KEV on that date. Lists of 100, 500, 1,000, and 5,000 CVEs are compared, together with coverage of subsequent KEV additions over 30 and 90 days. Repeated observations of each CVE are retained as a cluster during paired bootstrap resampling. Sensitivity analyses group events by KEV addition date, give equal weight to each distinct CVE, and restrict the panel according to repository commit history. The two versions share only 21–23 CVEs in their top-100 lists, although at least 98% of each version's list is retained between adjacent days. At the 90-day horizon, 420 positive CVE-date observations represent only 35 distinct CVEs. For top-5,000, pooled coverage is 7.86% for v4 and 15.71% for beta. The paired difference is 7.86 percentage points, with an exploratory 95% CVE-cluster percentile interval from −4.18 to 21.44 points. The Git audit shows that the retained bytes of 12 beta files have a commit date later than their score date. Three files were revised without changing the model-version or score-date header. Restricting the analysis to six dates whose retained files first appear in same-day commits also leaves the coverage difference highly uncertain. The study contributes a reproducible audit that links file provenance, changes in priority lists, score availability, and uncertainty in subsequent KEV coverage. Commit timestamps are only proxies for public availability, and KEV addition dates are not dates of first exploitation. A clean-environment replay reproduced the frozen outputs. An additional execution test on three previously unused July snapshots of released v5 achieved exact agreement between two implementations for eligible populations, subsequent KEV sets, top lists, and hit counts. This test establishes execution reproducibility, not a comparative advantage of released v5. The main comparative results describe a short retrospective beta panel and should not be generalized to the released v5 model, exploitation prediction accuracy, or organizational remediation outcomes.