{"id":7891,"date":"2026-04-22T09:01:00","date_gmt":"2026-04-22T09:01:00","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=7891"},"modified":"2026-04-22T09:01:00","modified_gmt":"2026-04-22T09:01:00","slug":"anthropic-bets-on-epss-for-the-coming-bug-surge","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=7891","title":{"rendered":"Anthropic bets on EPSS for the coming bug surge"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Anthropic\u2019s Mythos has intensified a problem that vulnerability management programs were already struggling to contain: too many vulnerabilities and not enough clarity about which ones matter.<\/p>\n

What changes with Mythos<\/a> \u2014 and the AI-based class of vulnerability discovery systems<\/a> it represents \u2014 is the speed at which software flaws can be found and exploited.<\/p>\n

That speed raises a more immediate question for defenders: Which vulnerabilities require action?<\/p>\n

Anthropic has pointed to one method. In guidance<\/a> tied to its work on AI-accelerated offense, the company recommended using the Exploit Prediction Scoring System (EPSS), a probabilistic model developed by the data scientists behind Empirical Security, and published through FIRST, as a way to triage vulnerabilities as discovery increases.<\/p>\n

According to Anthropic, \u201cPatching the KEV [CISA\u2019s Known Exploited Vulnerabilities catalog] list first, and then everything above a chosen EPSS threshold will help you turn thousands of open CVEs into a manageable queue.\u201d<\/p>\n

\u201cEPSS uses the same probabilistic models that weather forecasters do,\u201d Michael Roytman<\/a>, co-founder and CTO of Empirical Security and one of the original EPSS authors, told CSO. \u201cThe forecast is which vulnerabilities are likely to be exploited somewhere on the internet in the next 30 days.\u201d<\/p>\n

Roytman added, \u201cWe don\u2019t deal with rain by constantly having an umbrella over our heads. We have predictive models that tell us whether we should or should not bring an umbrella.\u201d<\/p>\n

Ed Bellis<\/a>, CEO of Empirical Security, told CSO that Anthropic\u2019s recommendation stood out because of who made it, not because EPSS is new. According to Bellis, it was the first time, to his knowledge, that a large language model provider had explicitly endorsed a probabilistic, purpose-built model for vulnerability prioritization.<\/p>\n

A system already under strain<\/h2>\n

Mythos arrives as the vulnerability ecosystem is already under strain.<\/p>\n

Most recently, the volume of new vulnerabilities forced NIST to scale back enrichment<\/a> of its National Vulnerability Database (NVD) to only certain CVEs. The NVD enriches vulnerability reports with CVSS scores, which are developed by FIRST, while EPSS provides a separate estimate of exploitation likelihood.<\/p>\n

\u201cThe fact that they\u2019re [NIST] narrowing down the vulnerabilities that they are going to focus on [for CVSS] is because it\u2019s all human-driven,\u201d Bellis said. EPSS, by contrast, is machine-driven and can be applied across all CVEs, with scores published daily.<\/p>\n

\u201cIt\u2019s machine-driven, and it\u2019s a machine learning model that ultimately scores that vulnerability,\u201d Bellis added. \u201cThe average vulnerability management practice today is not thinking about it from a machine-learning, data-driven perspective, but they could be.\u201d<\/p>\n

According to the Zero Day Clock, the mean time to exploit<\/a> a vulnerability after it\u2019s been discovered is going to reach one hour this year, and only one minute by 2028, down from 2.3 years in 2018.<\/p>\n

Security leaders weigh promise versus reality<\/h2>\n

Security vendors are increasingly incorporating EPSS scores into their systems.<\/p>\n

According to Roytman, EPSS has been incorporated into more than 120 security vendors\u2019 products, including CrowdStrike, Cisco, Palo Alto Networks, Qualys, and Tenable platforms.<\/p>\n

\u201cI do not think other CISOs realize how broadly EPSS has been adopted, but that adoption is great news for the industry,\u201d James Robinson<\/a>, CISO at Netskope, told CSO.<\/p>\n

\u201cEPSS, when applied to [software flaws], is an essential step in being able to know if this exploitable vulnerability applies to your implementation or operation,\u201d he said, adding that \u201cthe role that EPSS can play in identifying non-CVE vulnerabilities identified from Mythos and other upcoming models is extremely useful.\u201d<\/p>\n

Aaron Weismann<\/a>, CISO at Main Line Health, welcomed the faster discovery of vulnerabilities but questioned whether the guidance translates to sectors such as healthcare, telling CSO, \u201cIt\u2019ll be interesting to see how actionable those recommendations are for critical infrastructure \u2014 like healthcare, utilities, government, and others \u2014 where immediate and automated patching can be challenging due to the prevalence of legacy hardware and software.\u201d<\/p>\n

Not all defenders embrace the concept of EPSS or even CVSS to address the rapid discovery of vulnerabilities.<\/p>\n

\u201cTo be direct: Both CVSS and EPSS are fundamentally outdated in the \u2018Mythos\u2019 era and require a complete rethink,\u201d Ramy Houssaini<\/a>, chief cyber solutions officer of Cloudflare, told CSO. \u201cEPSS relies on lagging, 30-day historical data, but AI has collapsed the time-to-exploit into mere minutes. Instead of waiting for a predictive score to prioritize human-speed patching, organizations must shift to real-time defense.\u201d<\/p>\n

Exposure management will extend beyond CVEs<\/h2>\n

While most of the analysis of the power of Mythos to discover vulnerabilities has centered on common applications to which CVEs can be applied, its discoveries will most likely reveal millions of other vulnerabilities that don\u2019t meet this definition. \u201cA similar process is happening across clouds and applications, where there is no common enumerator across those applications,\u201d Empirical Security\u2019s Roytman said.<\/p>\n

\u201cMy application looks very different than yours, even if it\u2019s written in the same language,\u201d he added. \u201cSo, when we think about that probabilistic modeling expanding to all of exposure management, which might be a bigger problem than just CVEs themselves, we have to think about building local predictive models for applications, clouds, configurations, misconfigurations, and that is another exercise in taking advantage of the existing security tooling and building small, purpose-built models rather than having humans do the manual triage work.\u201d<\/p>\n

In short, Mythos and competing AI models will soon be able to find millions and millions of vulnerabilities that will not fit into the CVE model. \u201cWe see enterprises all the time that might have tens of millions of open instances of vulnerabilities, let alone the sheer volume of those classes of flaws that they\u2019re going to discover on the AI front,\u201d Bellis said.<\/p>\n

\u201cThis is a problem, but the sky is not falling,\u201d Roytman said. \u201cThere are methods for managing it.\u201d<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Anthropic\u2019s Mythos has intensified a problem that vulnerability management programs were already struggling to contain: too many vulnerabilities and not enough clarity about which ones matter. What changes with Mythos \u2014 and the AI-based class of vulnerability discovery systems it represents \u2014 is the speed at which software flaws can be found and exploited. That […]<\/p>\n","protected":false},"author":0,"featured_media":7892,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-7891","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/7891"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7891"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/7891\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/7892"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7891"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7891"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7891"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}