Reproducibility package for "Separating Recognition from Prediction in Known Exploited Vulnerabilities Benchmarks: A Landmark-Corrected Microsoft Windows Case Study"

This reproducibility package accompanies the manuscript “Separating Recognition from Prediction in Known Exploited Vulnerabilities Benchmarks: A Landmark-Corrected Microsoft Windows Case Study”. The archive contains the processed Microsoft Windows CVE cohort used in the final analyses, exact historical EPSS decision-time scores, study and model configurations, Python analysis code, reusable PATCH-Win pipeline modules, frozen publication-facing result tables, future-positive ranks, timing and workload audits, cluster-aware bootstrap sensitivity results, machine-readable analytical outputs, and SHA-256 integrity material. The package supports reconstruction of the distinction between current-state recognition and prospective prediction when CISA Known Exploited Vulnerabilities (KEV) membership may already be observable at the scoring landmark. The study uses a 2016–2025 Microsoft Windows cohort, a 2022–2025 confirmatory KEV-era cohort, and a pooled direct-EPSS landmark analysis combining the 2024 test cohort and the locked 2025 test cohort. The archive preserves the exact historical score observations and analytical inputs required to reproduce the reported landmark risk sets and event counts. Missing historical EPSS observations are not replaced with later values. The package also includes a 10,000-resample cluster-aware sensitivity analysis for the conventional locked-2025 EPSS D+7 result. Large raw mirrors of upstream public databases, internal editorial files, reviewer materials, and AI/similarity-assessment files are intentionally excluded. Upstream data providers retain their respective rights; source definitions, reconstruction information, and the analytical inputs used in this study are documented in the archive. DOI: 10.5281/zenodo.21862162