Complete Guide to Vulnerability Management for Modern Businesses
CVSS Scores and Vulnerability Prioritization Explained
CVSS (Common Vulnerability Scoring System) rates vulnerability severity on a 0-10 scale based on exploitability and impact factors. Effective prioritization combines CVSS scores with contextual factors like asset criticality, exploit availability, and network exposure to focus remediation on the highest-risk issues.
Andreas Johansson · Chief Executive Officer
Senior IT management leader with 25 years of experience in Cloud, Security, and Datacenter infrastructure.
Understanding CVSS Scores
The Common Vulnerability Scoring System (CVSS) is the industry standard for rating vulnerability severity. Maintained by FIRST (Forum of Incident Response and Security Teams), CVSS provides a numerical score from 0.0 to 10.0 that reflects the intrinsic characteristics of a vulnerability.
- CVSS Severity Ratings:
- Critical (9.0–10.0): Exploitation is trivial and impact is devastating. Remote code execution without authentication.
- High (7.0–8.9): Exploitation is feasible and impact is significant. Privilege escalation, data exposure.
- Medium (4.0–6.9): Exploitation requires specific conditions. Limited impact or requires user interaction.
- Low (0.1–3.9): Exploitation is difficult and impact is minimal. Information disclosure under specific conditions.
CVSS Score Components
CVSS v3.1 scores are calculated from three metric groups:
- Base Metrics — Intrinsic characteristics that don't change over time:
- Attack Vector: Network, Adjacent, Local, or Physical
- Attack Complexity: Low or High
- Privileges Required: None, Low, or High
- User Interaction: None or Required
- Scope: Unchanged or Changed
- Impact: Confidentiality, Integrity, Availability (each rated None/Low/High)
- Temporal Metrics — Characteristics that change over time:
- Exploit Code Maturity: Is there a public exploit?
- Remediation Level: Is there an official fix?
- Report Confidence: How verified is the vulnerability?
- Environmental Metrics — Organization-specific adjustments:
- Modified base metrics reflecting your specific environment
- Security requirements (Confidentiality, Integrity, Availability importance)
Why CVSS Alone Isn't Enough
CVSS scores reflect intrinsic vulnerability characteristics, not your specific risk. A CVSS 9.8 vulnerability on an isolated test server poses less actual risk than a CVSS 7.0 vulnerability on your internet-facing payment processing system.
Effective prioritization layers additional context:
- Asset criticality. Which business functions depend on the affected system? A vulnerability on a revenue-generating application takes priority over the same vulnerability on an internal wiki.
- Exploit availability. Is there a public exploit or proof-of-concept? Vulnerabilities with active exploitation in the wild demand faster response than theoretical risks.
- Network exposure. Is the affected system internet-facing, internally accessible, or isolated? Exposure level dramatically affects exploitability.
- Data sensitivity. Does the system handle PII, financial data, or healthcare records? Data sensitivity amplifies the impact of successful exploitation.
- Compensating controls. Are there firewalls, WAFs, or network segmentation that mitigate the vulnerability even before patching?
Building a Prioritization Framework
A practical prioritization framework combines CVSS severity with contextual factors into actionable tiers:
- Tier 1 — Immediate (24-48 hours): Critical CVSS + internet-facing + active exploit + high-value asset
- Tier 2 — Urgent (1-2 weeks): High CVSS + production system + known exploit available
- Tier 3 — Standard (30 days): Medium CVSS + production system OR High CVSS + internal-only + no known exploit
- Tier 4 — Planned (90 days): Low CVSS + any system OR Medium CVSS + development environment
How SeqOps fits
SeqOps scans your AWS, Azure and Google Cloud accounts and your Windows and Linux servers automatically, ranks every finding from Critical to Informational and explains how to fix it. It covers the scanning and prioritisation steps of the lifecycle; your team or your MSP does the remediation.