How early does VEDAS see the attacks coming?
Tested against 245 bugs CISA later confirmed under attack: VEDAS had already flagged 71% of them before the listing, EPSS 36%.
Generated by VEDAS. Scores as of 2026-11-01 19:19 UTC. Rebuilt every few hours from cve-scores, CISA KEV and vedas-signatures. How this works and its limits.
A bug is only a fair test of a warning score if you look at what the score said before anyone confirmed the attack. That is what this page does, for every bug CISA has added to its exploited list since 2025-04-13.
71%
of later-attacked bugs VEDAS had already flagged before CISA listed them
174 of 245 bugs confirmed under attack since 2025-04-13.
36%
had an EPSS score over the likely line before CISA listed them
The industry standard forecast flagged 87 of the same 245.
86 days
typical head start when VEDAS crossed the line before the listing
Measured on the 56 bugs we watched cross the line, not those already above it.
How this is measured
For each of the 245 bugs CISA added to its Known Exploited Vulnerabilities list after our first snapshot, we take its EPSS and VEDAS from the last cve-scores snapshot before the listing. Comparing today’s scores with the list would be circular: both scores take the list into account once a bug is on it. VEDAS counts as an early flag at 0.5 or higher (likely exploited); EPSS at 0.10 or higher (likely to be attacked within 30 days). Each score is read at its own actionable line. cve-scores published almost daily until 22 February 2026, paused until 8 August 2026, and was irregular after, so 62 bugs listed during the pause are left out rather than scored from stale data.
13 of the 245 attacked bugs had no EPSS score at all before CISA listed them. VEDAS had scored every one of them: a score of zero is the difference between a warning and silence.
This is the lead-time view. For the full patch-effort-against-attacks-covered curves, see VEDAS vs EPSS.
The clearest early catches
Bugs where VEDAS crossed the likely-exploited line (0.5) well before CISA confirmed attacks, largest head start first.
| CVE | VEDAS flagged | CISA listed | Days earlier |
|---|---|---|---|
| CVE-2016-3081 | 2025-04-13 | 2026-10-08 | 543 |
| CVE-2015-3306 | 2025-04-13 | 2026-10-08 | 543 |
| CVE-2015-5477 | 2025-04-13 | 2026-10-08 | 543 |
| CVE-2023-49105 | 2025-04-13 | 2026-08-27 | 501 |
| CVE-2019-1068 | 2025-04-13 | 2026-08-26 | 500 |
| CVE-2022-0995 | 2025-04-13 | 2026-08-26 | 500 |
| CVE-2021-23758 | 2025-04-13 | 2026-08-26 | 500 |
| CVE-2015-3246 | 2025-04-13 | 2026-08-26 | 500 |
| CVE-2015-5287 | 2025-04-13 | 2026-08-26 | 500 |
| CVE-2023-22894 | 2025-06-08 | 2026-10-08 | 487 |
| CVE-2008-4128 | 2025-04-30 | 2026-07-13 | 439 |
| CVE-2022-0492 | 2025-04-13 | 2026-06-02 | 415 |
| CVE-2009-3459 | 2025-04-13 | 2026-05-20 | 402 |
| CVE-2008-4250 | 2025-04-13 | 2026-05-20 | 402 |
| CVE-2009-1537 | 2025-04-13 | 2026-05-20 | 402 |
Limits
- Only bugs we were already scoring before CISA listed them can be tested this way; that is the 245 counted here, not every bug on the list.
- A snapshot must be within 7 days of the listing to count, so a bug’s score is never read from stale data.
- Median head start is measured only on bugs we watched cross the line, not bugs already above it at our first snapshot, so it is a floor, not an average of every lead.
- All of it is reproducible from the public cve-scores history and CISA’s catalogue.