Documentation/RPS score

RPS score

RPS is DevSecure's Risk Priority Score. It answers one question: which CVEs should a security team review first?

Formula

RPS = [(0.4 * CVSS/10) + (0.3 * EPSS_percentile)] * KEV_amplifier * 100

KEV_amplifier is 1.5 when the CVE is in CISA KEV and 1.0 otherwise.

Why RPS can exceed 100

RPS is intentionally not capped at 100. A CVE with maximum CVSS, maximum EPSS percentile, and confirmed KEV exploitation can score around 105. That separation makes actively exploited vulnerabilities stand out from theoretical severity.

Inputs

  • CVSS provides baseline severity.
  • EPSS provides exploitation likelihood.
  • CISA KEV confirms observed exploitation.
  • Exploit evidence adds public exploit context.
  • Patch evidence tells remediation teams whether verified fixes exist.

For field-level definitions, see API Reference: RpsBlock and API Reference: SignalsBlock.

Scope

RPS is a universal external risk signal. It does not know whether your instance is internet-facing, whether the affected package is reachable, or what compensating controls exist. Combine RPS with your asset and exposure context before making final remediation commitments.