RPS back-test: workload vs coverage
Among CVEs that were not yet in CISA KEV on a given day, CISA later added some to KEV. How many of those did each prioritisation strategy flag in advance, and how many CVEs did it have to flag to get there? Everything below uses only what was known on that day.
Report 20 Oct 2026 · data to 17 Oct 2026 · RPS formula 2.6.8
Terms
Workload
How many CVEs a strategy flagged on the day: the list a team would have to work through.
Coverage
The share of the CVEs CISA later added to KEV that the strategy had already flagged.
Lift
How much more often a flagged CVE was later added to KEV than an average CVE in the group (base rate 0.011%).
Results: 120-day window
Day zero 20 Jun 2026. 339,979 CVEs had an EPSS score and were not in KEV; CISA added 38 of them to KEV by 17 Oct 2026.
| Strategy on day zero | Workload (CVEs flagged) | Later added to KEV | Precision | Lift | Coverage (of 38) |
|---|---|---|---|---|---|
| RPS High or Critical | 1,091–1,093 | 2 | 0.18% | 16× | 5% |
| RPS top 1% | 3,400 | 5 | 0.15% | 13× | 13% |
| EPSS ≥ 99th percentile | 2,650 | 5 | 0.19% | 17× | 13% |
| RPS top 5% | 16,999 | 12 | 0.07% | 6.3× | 32% |
| EPSS ≥ 90th percentile | 32,795 | 16 | 0.05% | 4.4× | 42% |
| CVSS ≥ 9.0 | 40,560–41,958 | 20 | 0.05% | 4.3–4.4× | 53% |
| RPS Medium or above | 93,846–94,845 | 26 | 0.03% | 2.5× | 68% |
| CVSS ≥ 7.0 | 155,874–163,479 | 31 | 0.02% | 1.7–1.8× | 82% |
Flagged counts shown as a range: about 5% of the cohort had an NVD change after t0 and isn't in the 18 May 2026 NVD copy, so those CVEs are counted both without a CVSS score and at today's score. The later-KEV counts are exact.
What it shows
- RPS lists are smaller than CVSS thresholds and find more later KEV additions per CVE flagged. RPS top 5% flagged 58–59% fewer CVEs than CVSS ≥ 9.0, with about 1.4–1.5× its lift, at lower coverage (32% vs 53%). RPS Medium or above reached 68% coverage while flagging 39–43% fewer CVEs than CVSS ≥ 7.0.
- Before KEV, RPS roughly ties EPSS alone at the same workload. RPS top 1% and EPSS ≥ 99th percentile each flagged 5 of the 38. That's expected: among high-CVSS CVEs the EPSS percentile drives RPS. We don't claim RPS identifies future KEV additions better than EPSS on its own.
- RPS High or Critical is a short, precise list. About 1,091–1,093 CVEs with a high lift (16×, close to EPSS ≥ 99th percentile), but low coverage (5%). That fits its job: a small list to review first.
- Not measured here: what RPS adds once a CVE is in KEV (the KEV floor and multiplier), the explanations on every CVE page ("What would change this priority?"), exploit and fix evidence, Movers and CISA SSVC inputs.
Method: point-in-time inputs only
Day zero is 30, 60, 90 and 120 days before the latest EPSS date. A CVE is in the group if it had an EPSS score on day zero and wasn't in KEV on day zero; today's status doesn't matter, so CVEs rejected later still count. The outcome is a CISA KEV dateAdded after day zero.
- EPSS: FIRST's published file for day zero (every window uses EPSS v5).
- KEV: not in KEV on day zero, by construction, so the score has no KEV term.
- CVSS for the CVEs later added to KEV: the score NVD showed on day zero, rebuilt from NVD's CVE change history (vectors added, changed or removed by NIST or the CNA) or from an NVD copy taken on 18 May 2026, before every day zero.
- CVSS for everyone else: the NVD record if unchanged since before day zero, else the 18 May 2026 copy; where neither applies the CVE is counted both ways, which is why some workloads are ranges.
- RPS: the published formula and bands (2.6.8), fixed before the windows. Nothing was tuned on this outcome.
All four windows
Workload / later added to KEV, per strategy.
| Window | Day zero | Later KEV | Of which no CVSS on day zero | RPS High or Critical | RPS Medium or above | RPS top 1% | RPS top 5% | CVSS ≥ 9.0 | CVSS ≥ 7.0 | EPSS ≥ 99th percentile | EPSS ≥ 90th percentile |
|---|---|---|---|---|---|---|---|---|---|---|---|
| 30 days | 18 Sep 2026 | 12 | 1 | 1,203–1,205 / 1 | 104,187–105,453 / 5 | 3,750 / 1 | 18,750 / 3 | 44,896–46,480 / 5 | 175,785–184,076 / 8 | 2,932 / 3 | 36,210 / 5 |
| 60 days | 19 Aug 2026 | 32 | 0 | 1,151–1,152 / 1 | 99,774–100,930 / 16 | 3,606 / 3 | 18,030 / 6 | 43,085–44,786 / 11 | 168,060–176,216 / 25 | 2,807 / 4 | 34,802 / 11 |
| 90 days | 20 Jul 2026 | 37 | 2 | 1,114–1,115 / 1 | 96,142–97,236 / 24 | 3,483 / 6 | 17,416 / 10 | 41,363–42,802 / 17 | 159,391–167,799 / 30 | 2,711 / 4 | 33,601 / 18 |
| 120 days | 20 Jun 2026 | 38 | 2 | 1,091–1,093 / 2 | 93,846–94,845 / 26 | 3,400 / 5 | 16,999 / 12 | 40,560–41,958 / 20 | 155,874–163,479 / 31 | 2,650 / 5 | 32,795 / 16 |
Limitations
- Small event counts: 12 to 38 later KEV additions per window, so lifts are indicative; two or three CVEs change a cell.
- Known CVEs only: CVEs published after day zero are excluded, and many KEV additions are new CVEs. This measures known CVEs that were later exploited, not newly published ones.
- NVD only: CVSS comes from the NVD record (including CNA scores in it), not RPS's fallback sources, a slight disadvantage to RPS and CVSS for CVEs NVD hadn't scored.
- Ranges: some workloads are ranges (see the note under the results); the later-KEV counts are exact.
Lead time
DevSecure has stored every CVE's priority each day since 21 Oct 2026. A lead-time measure, built from DevSecure's own stored daily priorities rather than reconstructed inputs, will be added once there is enough snapshot history and enough later CISA KEV additions to support it properly. It has no fixed date: it depends on the evidence.
Data and reproducibility
Inputs are public: FIRST's daily EPSS files, the CISA KEV catalogue, and NVD's CVE and CVE change history APIs. Our query and history replay are internal; the method above is complete enough to repeat with those sources. Windows and baselines are fixed in advance for each refresh.
RPS ranks external risk. It doesn't set remediation deadlines: your organisation applies its own policy. See the methodology for the formula and bands.