Exploit Window Forecast (EWF)

EWF is a deterministic prioritization heuristic. Its 7/14/30/60-day outputs are not calibrated exploitation probabilities. No independent benchmark or probability calibration has been established. It also proposes an action-by date using configurable severity/KEV/score thresholds.

#Inputs

• CVSS base score (0-10)
• EPSS score (0-1), current
• CISA KEV (boolean)
• EPSS trend (optional): change over the last ~90 days when history exists

If EPSS is unavailable, the model still runs with CVSS + KEV only.

#Formula (v1)

1. Normalize CVSS: cvss_norm = clamp(cvss / 10)
2. Normalize EPSS: epss_norm = clamp(epss)
3. Trend boost (if history exists):
   • delta = last_epss - first_epss
   • trend_boost = clamp(delta * 1.5, 0, 0.15)
4. Base risk score:

base_risk = 0.35 * cvss_norm + 0.45 * epss_norm + 0.20 * kev_boost + trend_boost

5. Uncalibrated window score (logistic mapping; legacy API names retained):

prob(days) = sigmoid( (base_risk - 0.5) * 3.2 + timeFactor(days) * 1.2 )
where timeFactor(days) = log1p(days) / log1p(60)

#Action-by date (SLA)

Baseline by severity (via CVSS):

• Critical (>=9.0) -> 7 days
• High (>=7.0) -> 14 days
• Medium (>=4.0) -> 30 days
• Low -> 60 days

Adjustments:

• If CISA KEV, SLA <= 7 days
• If forecast_7d >= 0.6, SLA <= 7 days
• If forecast_30d >= 0.75, SLA <= 7 days
• If forecast_30d >= 0.55, SLA <= 14 days

#Tuning

To tune behavior without changing code structure:

• Increase or decrease weights in base_risk (CVSS / EPSS / KEV)
• Adjust trend_boost scale and cap
• Modify logistic scale factors (3.2) and (1.2)
• Adjust SLA thresholds and window cutoffs

#Storage

EPSS snapshots are stored in SQLite (epss_history). Snapshots are taken daily by the monitoring worker for recent CVEs and also updated opportunistically during scans.

#Determinism

Scores are deterministic for the same inputs. The action-by calendar date also depends on the current date. The API returns calibrated: false, model_kind: "uncalibrated_heuristic", and an interpretation notice. Missing or zero signals still produce nonzero logistic scores; do not interpret these as measured baseline risk.