Original Post: Exploit exploitability: prioritize supply chain findings with EPSS
Semgrep Supply Chain has integrated FIRST’s Exploit Prediction Scoring System (EPSS), providing daily updated scores that predict the likelihood of a vulnerability being exploited within the next 30 days. EPSS uses a machine learning model based on real-world data, such as the CISA’s Known Exploitable Vulnerability database, to offer dynamic, adaptive scores.
EPSS helps prioritize vulnerabilities, focusing on those most likely to be exploited, particularly when combined with Semgrep’s dataflow reachability analysis. While EPSS is a powerful tool, it does not customize its predictions for individual projects, guarantee future exploitation, or indicate the severity of vulnerabilities. Other tools like CVSS are necessary for assessing a vulnerability’s impact.
Semgrep Supply Chain reduces noise in vulnerability alerts using reachability analysis and further prioritizes actionable issues using EPSS, enabling focused and strategic remediation efforts. For more in-depth information, resources like the FIRST user guide and Semgrep demos are available.
Go here to read the Original Post