A score is a probability: s = P(exploitation activity is observed against the CVE in the next 30 days), with 0 < s < 1. The percentile ranks that score among all N scored CVEs. Call A(t) the number of CVEs scoring at least t:

percentile(s) = |{ c : s_c ≤ s }| / N  =  1 − A(s⁺) / N

median ≈ the t with A(t) = N / 2,   quantile q ≈ the t with A(t) = (1 − q) N

Why a rank is not a probability. A percentile only counts how many CVEs sit below, however far below. When most of the N scores crowd near zero, even a small score reaches the 90th percentile, so a high percentile can carry a small chance. Why a count above a threshold is enough. The share at or below s is one minus the share above it. The snapshot keeps A(t) on a fixed grid of thresholds: exact at every score with two significant digits, interpolated in between. The published percentile comes from unrounded scores, so it can differ from the rounded-score figure by a few thousandths.

Call the number of scored catalogue CVEs K and the number of all scored CVEs N. In a score bin b, the catalogue's distribution and everyone's are

f_KEV(b) = k_b / K,   f_all(b) = n_b / N,   ratio r(b) = f_KEV(b) / f_all(b)

share of the catalogue at or above t = k(t) / K,   P(KEV | s ≥ t) = k(t) / a(t),   lift = P(KEV | s ≥ t) / P(KEV)

Why the ratio is a likelihood ratio. r(b) compares how likely a score in bin b is for a catalogue CVE with how likely it is for any CVE. By Bayes' rule P(KEV | bin b) = P(KEV) × r(b). So a ratio of 20 means a CVE in that bin is 20 times as likely to be in the catalogue as one picked at random. Why "at or above" is the useful question. The share of the catalogue at or above t is the chance the threshold would have flagged a catalogue CVE. Neither number tells you anything about CVEs the catalogue hasn't listed.

Flag every CVE scoring at least t. With a(t) flagged of N, and k(t) of the K catalogue CVEs among them:

effort = a / N,   coverage = |flagged ∩ KEV| / |KEV| = k / K,   efficiency = |flagged ∩ KEV| / |flagged| = k / a

random baseline: E[coverage] = effort,   lift = coverage / effort,   fix exactly the catalogue: effort = K / N, coverage = 1

Why a random pick has coverage equal to its effort. A random selection of m CVEs from N contains each catalogue CVE with probability m / N. By linearity of expectation it holds m K / N of the K, a coverage of m / N, which is the effort. Anything above the diagonal is skill. Why fixing the catalogue proves nothing. It reaches coverage 1 at effort K / N only because the catalogue is also the yardstick. Why efficiency is small. Efficiency is a precision, and precision falls with the base rate K / N, even for a good ranking (exhibit VI).

The decision table is a function from three decision points to an outcome, and the queue sorts by its outcome (Act first), then by score:

f(exploitation, exposure, criticality) → {Track, Track*, Attend, Act},   exploitation = active if in the catalogue, forecast if s ≥ the chosen level, else none

E[X_n] = s₁ + … + s_n,   sd(X_n) = √( Σ s_i (1 − s_i) ) if independent

Why a sum of probabilities. Let X_i be 1 if finding i sees exploitation activity in the window and 0 otherwise, so E[X_i] = s_i. Expectation is linear, so the expected count among the first n is the sum of their scores, independent or not. The independence caveat. The spread formula does need independence, and findings often lack it: one campaign hits several related CVEs at once. The mean survives. The real spread is wider than the formula says. Why EPSS order wins this sum by construction. Sorting by score puts the largest s_i first, so no other order has a bigger sum in its top n. The table gives a little of that up to rank by exposure and criticality, which the scores can't see.

A queue of n findings is worked in order at a capacity of c fixes a week, spread evenly. The finding at rank r (1 is first) is fixed on day ⌈7r / c⌉:

weeks to clear = ⌈n / c⌉,   open after k weeks = max(0, n − ck),   fixed late if ⌈7r / c⌉ > d

c* = max over catalogue findings of ⌈7r_i / d_i⌉,   open risk R_k = Σ s_i over the findings still open,   a week of it ≈ 7/30 R_k

Why work over capacity. Work divided by rate is time, and time is what a deadline measures. Why the smallest safe capacity is a maximum. Finding i is on time when 7r_i / c ≤ d_i, which is c ≥ 7r_i / d_i. Every catalogue finding has to hold at once, so c has to reach the largest of those bounds. A short deadline deep in the queue is what pushes it up, and that's why the order matters. Why sum the scores. Each score is the chance of exploitation activity in a 30-day window, so the open findings' scores add to the expected number that will see some. A week is about 7/30 of that, if the chance is spread evenly.

A forecaster is calibrated when, among all cases it scored s, a fraction s happened. Call y the outcome (1 or 0):

calibration: E[y | score = s] = s,   Brier score B = (1 / n) Σ (s_i − y_i)²

P(exploited | flagged) = P(flagged | exploited) P(exploited) / [ P(flagged | exploited) P(exploited) + P(flagged | not) (1 − P(exploited)) ]

Why the points scatter. In a bin of n forecasts with observed fraction p, the standard error is √(p(1 − p) / n), so a calibrated forecaster's points sit near the diagonal, within about two standard errors. An over-confident forecaster says 0.9 and sees far less. An under-confident one says 0.9 and sees more. Why base rates dominate. When P(exploited) is small, unexploited CVEs vastly outnumber exploited ones, so even a small false-positive rate produces many false alarms. Counting the same thing out of 10,000 CVEs makes the arithmetic easy to see.