Introducing EPSS in Dependabot Alerts 🚀

[ghostinhershell]

We are excited to announce that Dependabot alerts now feature the Exploit Prediction Scoring System (EPSS) from the global Forum of Incident Response and Security Teams (FIRST). This enhancement will help you better assess and prioritize vulnerability risks in your dependencies.

What is EPSS?

EPSS scores predict the likelihood of a vulnerability being exploited. The scores range from 0 to 1 (0 to 100%), where higher scores indicate a higher risk of exploitation. Additionally, we display the EPSS score percentile, which shows how a vulnerability compares to others in terms of exploitation likelihood.

How to Interpret EPSS Scores

For example, a vulnerability with a 90.534% EPSS score at the 95th percentile means:

There is a 90.534% chance that the vulnerability will be exploited within the next 30 days.

• 95% of other vulnerabilities are less likely to be exploited.
• By using EPSS scores, you can prioritize addressing dependency vulnerabilities based on their likelihood of being exploited.

Availability

This feature is available on GitHub.com today and will be included in GitHub Enterprise Server starting with version 3.17.

Learn More

• FIRST’s EPSS User Guide
• Read more about viewing, sorting, and filtering Dependabot alerts in GitHub’s Dependabot docs
• Read more about this in the GitHub Blog: Dependabot helps users focus on the most important alerts by including EPSS scores that indicate likelihood of exploitation, now generally available
  Stay secure with the new EPSS integration in Dependabot alerts!

[super-sayan]

Hi, is there a chance that in future updates will be possible to configure Dependabot to score severity depending on EPSS as well? To use this table for example:

EPSS Range	Likelihood of Exploitation	Severity Mapping
0.00		Note (1)
0.01 - 0.10	Very Low	Low (2)
0.11 - 0.30	Low	Medium (3)
0.31 - 0.60	Moderate	High (4)
0.61 - 1.00	High	Critical (5)

And calculate average severity depending on both cvss and epss for more accurate vulnerability ranking and less false positivity?