Performance
The Empirical Foundation model is designed to be trusted the same way you would trust any operational measurement system: it makes a clear, testable claim, it is evaluated against real outcomes, and it is monitored continuously as conditions change.
EMPIRICAL FOUNDATION MODEL BENCHMARKS
Jan 1, 2026 – May 31, 2026
9/10
Focusing on just the top 2% of the Empirical Foundation model, 9 out of every 10 prioritized vulnerabilities showed exploitation activity after scoring (covering 75% of all exploited vulnerabilities).
90%
Focusing on just the top 7% of the Empirical Foundation model, remediates 90% of observed exploited vulnerabilities (within 30 days after scoring).
19,000+
Our models are trained on over 19,000 known exploited CVEs.
Jan 1, 2026 – May 31, 2026
Empirical Foundation
Model Benchmarks
01 · EFFICIENCY VS COVERAGE
The Efficiency View
The efficiency plot compares the tradeoff between how efficiently resources are allocated against complete coverage of all observed exploited vulnerabilities. As the threshold for remediation is lowered, coverage improves, but at the cost of efficiency. Better models push up and to the right. Clearly, not all scoring systems are created equal.
Focusing on just the top 2% of the Empirical Foundation model, 9 out of every 10 prioritized vulnerabilities showed exploitation activity after scoring (covering 75% of all exploited vulnerabilities).
EFFICIENCY VS COVERAGE
CVSS Top 2% limits to everything scored at 10, 1 out of every 10 prioritized vulnerabilities showed exploitation activity after scoring (covering 8% of all exploited vulnerabilities).
02 · COVERAGE VS EFFORT
The Capacity View
The Coverage vs Effort curve is the most intuitive chart for practitioners because it answers, “If we can only work on X% of the backlog, how much of the observed exploitation activity do we cover?” This chart will help you understand the tradeoffs inherent in any prioritization strategy.
Focusing on just the top 7% of the Empirical Foundation model, remediates 90% of observed exploited vulnerabilities (within 30 days after scoring).
COVERAGE VS EFFORT
Because CVSS is coarse, you’re stuck between:
10% effort (CVSS 9.8 and above), 30% coverage of all exploited vulns (within 30 days of scoring)
2.3% effort (CVSS 9.9 and above), 9.5% coverage of all exploited vulns (within 30 days of scoring)
MODEL TERMINOLOGY
Effort, Efficiency, and Coverage
Prioritized Incorrectly
Ignored Correctly Prioritized FALSE POSITIVES FALSE NEGATIVES TRUE POSITIVES
METHODOLOGY
Our models are trained on over 19,000 known exploited CVEs
Our local models are trained directly on your organization's vulnerability and remediation data, learning the patterns, priorities, and risk tolerances unique to you. The result is data you can defend in a board meeting, one grounded in your own evidence rather than industry averages.
10x
It would take more than 10x people and resources to prioritize potential threats using CVSS than Empirical.
CVSS 9+ (Critical)
Empirical Radiant (Same Effort)
BETTER COVERAGE & EFFICIENCY
6x
You will be 6x more efficient at remediating actual threats using Empirical than using CVSS.
CVSS 7+ (High to Critical)
Empirical Radiant (Same Coverage)
LESS EFFORT, MORE EFFICIENCY
Local model results may vary depending on your security dataset.