Anthropic's April 2026 security-operations guide recommends using EPSS (Exploit Prediction Scoring System) to prioritize vulnerability remediation, marking a shift toward predictive risk scoring over exhaustive patching approaches.

The guidance appears in a practical context alongside standard hardening measures like CISA vulnerability tracking and deployment automation. This reflects how organizations now handle vulnerability backlogs. Security teams face a structural problem: they cannot patch everything immediately. Thousands of disclosed vulnerabilities exist at any moment, but exploits target a fraction of them.

EPSS addresses this constraint directly. Rather than treating all vulnerabilities equally, the system predicts which ones attackers will likely exploit within the next 30 days based on threat intelligence, technical characteristics, and exploit availability. The scoring mechanism lets teams concentrate resources on high-probability targets.

The recommendation signals broader acceptance of predictive prioritization in enterprise security. Traditional approaches relied on CVSS (Common Vulnerability Scoring System) severity ratings, which measure technical impact but not real-world attack likelihood. A vulnerability rated 9.8 might see zero exploitation attempts while a 7.2 faces active weaponization. EPSS fills that gap by adding temporal, behavioral data.

Anthropic's endorsement carries weight in security circles. The company's integration of EPSS into foundational guidance suggests the metric has matured beyond academic interest into operational utility. Organizations using Claude for security automation or threat analysis likely reference this framework.

The practical implication cuts deep. Security teams can reduce alert fatigue and focus engineering effort where threats materialize. In large enterprises managing thousands of vulnerabilities monthly, this prioritization method prevents the common outcome where urgent patches get lost in noise.

EPSS remains imperfect. Predictions depend on data quality and lag real-world exploitation by design. But the shift from "patch everything" to "predict and priorit