> For the complete documentation index, see [llms.txt](https://help.aikido.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.aikido.dev/code-scanning/miscellaneous/use-epss-values-to-further-reduce-noise.md).

# Exploit Intelligence with KEV and EPSS

Aikido uses exploit intelligence from two sources to help you focus on CVEs that matter: the **CISA Known Exploited Vulnerabilities (KEV)** catalog and the **Exploit Prediction Scoring System (EPSS)**. KEV always influences severity for actively exploited CVEs. EPSS-based prioritization is optional and can further **auto-ignore** or **downgrade** low-risk vulnerabilities based on predicted exploit likelihood.

## How exploit intelligence works in Aikido

Aikido refreshes both data sources daily and applies them when calculating each issue's severity score.

### CISA KEV (always on)

The [CISA KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) lists CVEs with confirmed active exploitation in the wild. Aikido syncs this list every day.

When a CVE appears on the KEV catalog, Aikido **raises its severity by 5 points** (up to a maximum score of 100). You'll see **Actively exploited vulnerability** in the issue's severity breakdown, with the description *It is actively being exploited in the wild.*

KEV-based scoring is always enabled. You don't need to turn anything on.

### EPSS (optional)

[EPSS](https://www.first.org/epss/) estimates the probability that a CVE will be exploited in the wild within the next 30 days. A score of 1% means there's roughly a 1-in-100 chance of exploitation in that window.

Aikido syncs EPSS scores daily. When you enable EPSS-based prioritization, Aikido can use those scores to ignore or downgrade findings that are unlikely to be exploited soon.

EPSS is **off by default**. Workspace admins enable it in [Advanced Settings](https://app.aikido.dev/settings/advanced).

### How KEV and EPSS work together

KEV and EPSS serve different purposes. KEV reflects **confirmed** exploitation. EPSS predicts **future** exploitation likelihood.

Aikido applies them in a specific order during severity scoring:

1. **KEV**: If the CVE is on the CISA catalog, severity goes up by 5 points.
2. **Public proof-of-concept (PoC)**: If exploit code for the CVE is available on GitHub, severity goes up by 1 point.
3. **EPSS rules**: Only run when the CVE is **not** on KEV and has **no** public PoC.

{% hint style="info" %}
CVEs that are actively exploited or have a public PoC are never auto-ignored or downgraded by EPSS rules. This keeps real-world threat signals from being filtered out by low EPSS scores.
{% endhint %}

| Signal         | Source              | Default behavior    | Configurable?       |
| -------------- | ------------------- | ------------------- | ------------------- |
| **KEV**        | CISA catalog        | Severity +5         | No, always on       |
| **Public PoC** | GitHub exploit code | Severity +1         | No, always on       |
| **Low EPSS**   | FIRST.org           | Ignore or downgrade | Yes, optional rules |

Click an issue's severity score to see which rules applied, including KEV, PoC, and EPSS adjustments.

## Configure EPSS-based prioritization

{% stepper %}
{% step %}

### Open Advanced Settings

Go to **Settings** → **Advanced** and find the **EPSS-Based Prioritization** section.
{% endstep %}

{% step %}

### Manage EPSS rules

Click **Manage** in the EPSS-based prioritization section.

![Settings for scan frequency and advanced scan configuration in a security monitoring dashboard.](/files/zxk5vchjKszTMzMoJV3v)
{% endstep %}

{% step %}

### Choose your rules

Select which EPSS rules to apply in your workspace:

* **Auto-ignore issues with an EPSS below 1%**: Auto-ignores CVEs with a very low predicted chance of exploitation.
* **Lower severity with 10 points for EPSS below 5%**: Downgrades severity by 10 points. For example, a high-severity issue with score 60 becomes 50.
* **Lower severity with 5 points for EPSS between 5% and 10%**: Downgrades severity by 5 points.

![EPSS-based vulnerability prioritization options for automated issue ignoring and severity adjustment.](/files/7HJvx7mAt0rW7yfuv8LI)
{% endstep %}

{% step %}

### Save and rescan

Click **Save EPSS-based prioritization** to apply your rules.

Manually trigger a rescan to apply the new prioritization immediately, or wait until the next scheduled scan for changes to take effect.
{% endstep %}
{% endstepper %}

## Important notes

* Aikido checks EPSS and KEV scores daily. When an EPSS value crosses a threshold, an issue may be **ignored** or **unignored** on the next scan.
* EPSS-based prioritization is available everywhere in Aikido: your IDE, PR gating in CI, and the feed.
* When you disable EPSS-based prioritization, issues that were previously auto-ignored by EPSS rules are unignored again. KEV and PoC severity adjustments are unaffected.
* EPSS rules never override KEV or public PoC signals. Actively exploited CVEs stay prioritized even when their EPSS score is low.

## Related features

* [**How is severity score calculated?**](/getting-started/core-functionalities/how-is-severity-score-calculated.md): Overview of Aikido's 0-100 severity model and contextual adjustments.
* [**CVE Exploitability Analysis**](/aikido-agent/cve-exploitability-analysis.md): Codebase-specific Agent triage for dependency CVEs.
* [**Reachability analysis**](/getting-started/reachability-analysis/introduction-to-reachability-analysis.md): Filters findings with no execution path to vulnerable code.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.aikido.dev/code-scanning/miscellaneous/use-epss-values-to-further-reduce-noise.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.