Category: Vulnerability & Exposure Management
Common Vulnerability Scoring System
Also known as: CVSS, CVSS score, CVSS framework
Simply put
The Common Vulnerability Scoring System (CVSS) is a standardized way to rate how severe a security vulnerability is, using a numeric score that typically ranges from 0 (minor) to 10 (most severe). It gives organizations a consistent method to compare and prioritize vulnerabilities rather than relying on subjective judgment. It is important to note that CVSS measures severity, not overall risk, so it is one input among several when deciding what to fix first.
Formal definition
CVSS is a framework for producing a qualitative and numeric measure of the severity of information system vulnerabilities, with scores ranging from 0 to 10. It provides a standardized method to evaluate, rank, compare, and prioritize reported vulnerabilities in a repeatable manner. Per NIST, CVSS supplies a qualitative measure of severity and is explicitly not a measure of risk; a severity score does not by itself account for organization-specific factors such as asset value, exposure, compensating controls, or threat likelihood, which must be assessed separately to derive actual risk.
Why it matters
For security leaders, CVSS provides a common language for discussing vulnerability severity across teams, vendors, and tools. Without a standardized scale, organizations tend to fall back on subjective judgment about how serious a given flaw is, which produces inconsistent prioritization and makes it difficult to compare findings from different sources. A shared 0-to-10 scale lets leadership set defensible thresholds and communicate severity to non-technical stakeholders in terms that carry consistent meaning.
Who it's relevant to
Virtual and Fractional CISOs
A vCISO or fractional CISO typically uses CVSS as a governance tool to help clients establish consistent, defensible criteria for prioritizing remediation. Their role centers on strategy and process, advising on how to translate CVSS severity into risk-based decisions using business context. They generally do not perform the hands-on scanning or tool administration that generates the scores; that operational work usually sits with the client's team or a separate service. Accountability for remediation decisions typically remains with the client organization and its officers.
Vulnerability Management and Security Operations Teams
Operational teams responsible for scanning, triage, and patching rely on CVSS to rank and compare the vulnerabilities their tools report. For these teams, the score is a practical input into daily workflow, but it must be combined with local context such as which assets are exposed or business-critical before remediation is sequenced.
GRC, Risk, and Compliance Functions
Governance, risk, and compliance stakeholders use CVSS as a standardized reference point when documenting how vulnerabilities are evaluated and prioritized. Because CVSS measures severity rather than risk, these functions are typically responsible for layering in organizational risk factors so that reported scores support, rather than substitute for, a defensible risk assessment.
Executives and Boards
Executives and board members benefit from CVSS as a consistent way to understand how severe reported vulnerabilities are without needing deep technical knowledge. Security leaders should be careful to frame CVSS scores as severity indicators, not statements of business risk, so leadership does not over- or under-react to a single number when setting expectations and resourcing decisions.
Inside CVSS
Base metric group
The metrics that capture the intrinsic, constant characteristics of a vulnerability, including exploitability factors such as attack vector, attack complexity, privileges required, and user interaction, along with the impact to confidentiality, integrity, and availability. This group produces the score most commonly published by vendors.
Temporal / Threat metric group
Metrics that reflect characteristics of a vulnerability that may change over time, such as the maturity or availability of exploit code and the status of remediation. In newer versions of the specification this group is oriented toward threat information and is used to refine the Base score.
Environmental metric group
Metrics that allow an organization to adjust the score to reflect its own context, including the criticality of the affected asset and any compensating or mitigating controls. Applying these metrics is typically the responsibility of the adopting organization rather than the vendor.
Numerical severity score
A value typically ranging from 0 to 10 that expresses the assessed severity of a vulnerability, often mapped to qualitative labels. The score is one input into risk assessment and does not by itself represent complete organizational risk.
Vector string
A structured, compact representation that documents the individual metric values used to produce a given score, allowing the derivation of the score to be reviewed and reproduced.
Governing specification
An open, vendor-neutral specification maintained by the Forum of Incident Response and Security Teams (FIRST), which defines the metrics and scoring methodology so that scores are calculated consistently across tools and organizations.
Common questions
Answers to the questions practitioners most commonly ask about CVSS.
Does a high CVSS score mean a vulnerability is an urgent priority for my organization?
Not necessarily. A CVSS base score reflects the intrinsic severity of a vulnerability in a general sense, but it does not account for your specific environment, the exposure of the affected asset, compensating controls, or whether the vulnerability is actively being exploited. A high base score on a system with no network exposure and strong compensating controls may warrant less urgent attention than a moderate-scoring flaw on an internet-facing, business-critical asset. CVSS is an input to prioritization, not a complete prioritization decision on its own. A virtual CISO typically helps translate raw scores into risk-based priorities that reflect business context.
Is CVSS a measure of the actual risk a vulnerability poses to my business?
CVSS is often described as a risk score, but strictly it measures technical severity rather than organizational risk. Risk generally combines the likelihood of exploitation, the value and exposure of the affected asset, and the potential business impact. CVSS base metrics describe characteristics of the vulnerability itself and do not, on their own, capture threat activity or business consequence. Some CVSS versions include optional temporal and environmental metrics intended to add context, but these are frequently not applied in practice. Treating a base score as a full risk assessment is a common mistake that experienced security leaders work to correct.
How should we use CVSS scores alongside our vulnerability management program?
CVSS scores are typically used as one factor within a broader vulnerability management workflow. Many organizations combine base scores with additional signals such as asset criticality, network exposure, exploit availability, and threat intelligence to determine remediation order. A virtual CISO often advises on how to define this scoring-to-priority logic, including where to set severity thresholds and how to document exceptions, so that scoring drives consistent, defensible decisions rather than being applied mechanically.
Who is responsible for acting on CVSS scores in an organization?
Responsibility for remediation activity usually sits with operational teams such as IT, infrastructure, or application owners, while the governance framework that defines how scores map to timelines and priorities is often shaped with security leadership input. A virtual CISO generally advises on and helps direct this framework, but accountability for security decisions and remediation typically remains with the client organization and its officers. It is important to distinguish between advising on prioritization approach and performing the hands-on remediation work, which is usually out of scope for a vCISO engagement unless explicitly contracted.
Do CVSS scores help demonstrate compliance with frameworks or standards?
Vulnerability severity scoring can support activities relevant to frameworks and standards that expect a defined vulnerability management process, but a CVSS score by itself does not establish compliance or certification. Standards that reference vulnerability handling generally expect a documented, repeatable process for identifying, prioritizing, and remediating issues within defined timeframes. CVSS can be one component of that process. A virtual CISO may help align scoring practices with such expectations to support readiness, while noting that supporting readiness is distinct from asserting that any specific requirement is met.
How do we handle differences between CVSS versions or scores from different sources?
CVSS has evolved across versions, and scoring can differ between the version used and the source that publishes a score, since some sources report base scores while others may incorporate additional metrics. To keep prioritization consistent, many organizations standardize on which version and which source they treat as authoritative, and document how they reconcile discrepancies. A virtual CISO can help establish this consistency as part of governance, so that teams interpret scores uniformly. The value of this depends on organizational maturity, defined scope, and cooperation from the teams that own the affected assets.
Common misconceptions
A high CVSS score means a vulnerability is automatically a high risk to my organization.
CVSS Base scores describe the intrinsic severity of a vulnerability, not the risk to a specific environment. Actual organizational risk depends on factors such as asset criticality, exposure, and compensating controls, which are reflected through the Environmental metrics and broader risk assessment. A security leader typically contextualizes scores against the specific environment before setting remediation priorities.
The CVSS score published by a vendor is the final, complete measure of severity for everyone.
Vendors often publish only the Base score, which is intentionally environment-independent. The Temporal or Threat and Environmental metric groups are meant to refine that score for real-world and organization-specific conditions, and applying them is generally left to the adopting organization.
Prioritizing purely by CVSS score is a complete vulnerability management strategy.
CVSS is one input into prioritization, not a full program. Effective prioritization also considers business context, threat activity, and organizational maturity. Treating the score as the sole driver risks misallocating remediation effort, which is why security leaders frame CVSS output within a broader governance and business-risk process.
Best practices
Treat CVSS Base scores as a starting point and apply Environmental metrics so that severity reflects your organization's actual asset criticality, exposure, and compensating controls.
Combine CVSS scores with threat context and business impact when setting remediation priorities, rather than sorting solely by numerical score.
Preserve and review vector strings alongside scores so that the reasoning behind a rating can be understood, reproduced, and challenged when necessary.
Clarify in the engagement scope whether producing, adjusting, or acting on CVSS scores is a client responsibility or part of the security leader's advisory role, since a virtual CISO typically advises rather than executes operational scoring.
Communicate CVSS-derived priorities to executives and boards in business-risk terms, not just as raw scores, to support informed decision-making.
Avoid presenting CVSS scores as a guarantee of breach prevention or as evidence of compliance, and distinguish between supporting readiness and asserting certification.