A number without a definition cannot support decisions
Two dashboards show different “overall” scores for the same vulnerability. One repeats a source score; the other uses environmental metrics. The disagreement can distract a review from the decision required. “Overall” is a tool label, not a universal CVSS score category.
To compare results, retrieve the CVSS version, evaluated metric groups, source vector and display rules. Keep the original score separate from any contextual assessment. An estate-wide average or internal priority serves another purpose and needs a distinct name.
Read v3.1 and v4.0 using their own terminology
CVSS v3.1 distinguishes Base, Temporal and Environmental metric groups. The first describes intrinsic vulnerability characteristics; the others account for time-related factors and the environment. The result depends on available metrics and the values assigned to them.
CVSS v4.0 uses Base, Threat and Environmental groups and the names CVSS-B, CVSS-BT, CVSS-BE and CVSS-BTE to identify the groups explicitly evaluated. Supplemental metrics provide context without changing the numerical score. The two versions have different models: changing a v3.1 vector’s prefix does not create a valid v4.0 vector.
Sources: FIRST: CVSS v3.1 specification, FIRST: CVSS v4.0 specification and nomenclature
Obtain and maintain contextual information
A calculator does not verify service criticality, function exposure or protection effectiveness. Appoint a contact able to provide configuration evidence or business information. Link it to the system and verification date. Copying context from another environment may change the number while reducing reliability.
Plan updates too: new exposure, an enabled function, a changed control or documented exploitation. Unspecified metrics take the values defined by the standard; that is not equivalent to verifying the actual environment. Choose a level of detail your teams can maintain, with identified revision triggers.
Sources: FIRST: CVSS v4.0 user guide
Fictional example: the same defect, two documented decisions
A library affected by DEMO-CONTEXTE-01 is present in two services. Service A supports important operations and exposes the vulnerable function to external users. For B, the team does not yet know whether that function is enabled.
For A, the case prepares a priority fix with operations. For B, it requests configuration evidence with an owner and deadline. Missing information does not justify a lower score. Once context is established, metrics can be populated and the result retained with their rationale. The decision remains understandable to someone who did not perform the calculation.
Separate severity, exploitation and business risk
FIRST explains that the base score measures severity and cannot alone assess risk. Priority also reflects business consequences and treatment constraints. It explains why one action precedes another. Even a contextual CVSS score cannot be directly converted into financial loss.
EPSS estimates the probability that a CVE will be exploited in the wild within the next thirty days. It does not predict compromise of your system. These inputs complement one another: CVSS describes severity, exploitation evidence informs the threat and your context guides the decision.
Sources: FIRST: CVSS v4.0 user guide, FIRST: EPSS definition
Make each score transferable and reviewable
Retain the source score, vector, CVSS version, access date and contextual changes. Add the rationale for the values and the relevant contact. Where several CVSS versions coexist, display results separately. This record enables recalculation and distinguishes genuine changes from a change in method.
CyberLifeCycle defines prioritisation criteria with you, assesses context data and prepares decision case files. Teams receive explained priorities with supporting sources and assumptions. Track decision-making time and cases requiring reconstruction to measure the remaining work.
Sources consulted
- FIRST: CVSS v3.1 specificationAccessed on 30 October 2026.
- FIRST: CVSS v4.0 specification and nomenclatureAccessed on 30 October 2026.
- FIRST: CVSS v4.0 user guideAccessed on 30 October 2026.
- FIRST: EPSS definitionAccessed on 30 October 2026.