A percentile is a ranking measure that shows where a score sits compared with the rest of a group. If a vulnerability is in the 90th percentile, its score is higher than 90% of the other items in that set. Percentiles describe relative position, not the raw value itself.
In cyber security, percentiles are useful for turning large score lists into practical priorities. Tools like EPSS use them to show which CVEs are most likely to be exploited compared with the broader population of scored vulnerabilities. That helps defenders sort patch queues, focus on the most at-risk issues, and avoid treating every alert as equally urgent. Percentiles are especially helpful when raw scores are close together, but they do not replace context such as asset exposure, business impact, or compensating controls.