jperezduerto.info
Security in depth · Unit 30 · Lesson 8 of 11
A probability is not an incident verdict
Read a 4% forecast and a 91st-percentile rank without inventing a local incident probability.
Helpful before thisReporting: turn evidence into useful improvements
After this lesson you can
- Interpret an EPSS score separately from its percentile and local incident evidence.
A forecast, a ranking, and a local observation answer different questions.
Read the event being forecast
An EPSS score estimates the probability that exploitation activity associated with a vulnerability will be observed in the wild during the next thirty days. FIRST describes the model’s target through activity that its data partners detect, record, and share. That observation boundary matters: a forecast is not complete visibility into every event.
The following numbers are invented for this exercise, not a current score for a real vulnerability. Assume the affected product is present; no local incident conclusion has been established.
Supplied briefing snapshot
- P1: The dated forecast record lists score 0.04, equivalent to 4%. Its model context is recorded alongside it.
- P2: The same record lists percentile 0.91: its score is higher than those of 91% of the currently scored vulnerabilities.
- P3: A local configuration changed unexpectedly. Its authorization and cause are under review; no connection to this vulnerability has been demonstrated.
Keep three conclusions separate
P1 is a forecast about observed exploitation of the vulnerability, not a 4% incident probability for this organization. P2 expresses relative ranking, not 91% probability. A high percentile can coexist with a much smaller absolute probability.
P3 deserves review on its own evidence. The forecast neither clears the change as harmless nor proves exploitation caused it. Local exposure, consequences, and credible incident observations remain separate prioritization inputs.
Keep the score’s date because estimates and rankings can change. Do not round 4% down to “no risk,” and do not relabel the forecast as an assessment of damage.
Model briefing: 4% forecast; relative rank above 91%; local authorization and cause unresolved.
Terms you met
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
Which interpretation of P1-P3 is supported?
Show the answer
Correct answer: The forecast is 4%, the percentile is a relative rank, and the local change still needs independent review. The two EPSS fields describe a vulnerability forecast and its ranking. Neither establishes the cause or significance of P3.
Try it
- WriteWrite a three-line briefing interpreting score, percentile, and local incident status. Model P1 as 4% forecast probability, P2 as relative rank, and P3 as an unresolved local observation requiring its own review.