Does CTI Forecast see exploitation coming?
We replay the past week by week. At each date the model only knows what had been published before; we then check which vulnerabilities CISA added to its KEV catalog (confirmed exploitation) over the following 30 days. The model is evaluated on weeks it did not see during training.
Comparing methods
Each week, each method ranks the CVEs mentioned by security research and not yet exploited. We count how many of its top picks are added to KEV within 30 days. Total over 6 weeks, 194,971 candidate CVEs, 61 added to KEV (base rate: 0.031%).
| Method | AUC | Found in top 10 | Found in top 25 | Found in top 50 |
|---|---|---|---|---|
| CTI Forecast (learned model) | 0.81 | 0 | 3 | 5 |
| Mention volume alone | 0.80 | 0 | 5 | 5 |
| EPSS alone | 0.58 | 0 | 0 | 1 |
What these numbers mean
The noise of security research is a signal. To tell which vulnerabilities will be added to KEV within the month, the volume and dynamics of mentions in publications predict clearly better than EPSS alone. EPSS remains useful to estimate the probability of exploitation in absolute terms; CTI Forecast uses it as one variable among others.
The limitations, plainly. The history still covers few weeks and few positive cases (61): figures vary from week to week and the model does not yet beat mention volume alone. It is retrained weekly and this page updates with it. A forecast helps you prioritise; it is not a certainty.
Weights learned by the model
Logistic regression coefficients on standardised variables: positive = increases the probability of exploitation, negative = decreases it.
| Variable | Weight |
|---|---|
| mentions_7d | +0.58 |
| mentions_prev_7d | +0.34 |
| epss | +0.32 |
| acceleration | +0.15 |
| new_cve | +0.13 |
| epss_percentile | +0.08 |
| regularity | -0.14 |
| cve_age | -0.53 |
Sources
Confirmed exploitation: CISA Known Exploited Vulnerabilities catalog (version 2026.11.06). EPSS probabilities: FIRST.org / Empirical Security, scores of 6 November 2026. Mentions: security research publications tracked by CTI Forecast.
