Queue Shock at Model Upgrades: A Longitudinal Audit of EPSS v2–v5 Rank Stability and Prioritization Workload

Abstract

Background: EPSS publishes daily probabilities and percentiles to help defenders prioritize vulnerabilities. Major model replacements may disrupt operational queues, but this discontinuity has not been quantified across public EPSS versions. Objective: We measured how EPSS v2→v3, v3→v4, and v4→v5 transitions changed rankings, bounded priority sets, threshold classifications, and score coverage. Methods: A protocol was frozen before primary execution. We acquired 96 official daily archives covering 30 adjacent-day controls before each transition, the preceding day, and the transition day. Analyses used CVEs present on both compared days and reported additions and removals separately. Prespecified outcomes included rank correlations, score and percentile displacement, Jaccard similarity for five queue definitions, six threshold policies, and time-aligned CISA KEV stratification. The tested pipeline was rerun to verify a canonical result hash. Results: Transition-day Spearman correlations were 0.670, 0.749, and 0.834, compared with control medians of 0.99994, 0.99988, and 0.99962. Top-1,000 Jaccard similarities were 0.321, 0.280, and 0.416. The 95th percentile of absolute percentile movement reached 0.476, 0.437, and 0.352. At EPSS ≥0.10, 4.79%, 5.36%, and 4.02% of shared CVEs changed classification. The v3→v4 transition removed 11,576 CVEs and added 59. Every primary transition shock exceeded all 30 matched controls. Conclusions: A major EPSS release is a prioritization regime change, not an ordinary daily refresh. Defenders should version score-based policies, dual-run queues, budget for reclassification, and retain pre-transition snapshots.