Severity scores: why CVSS is not the whole story

CVSS, the Common Vulnerability Scoring System, gives each weakness a score from 0 to 10 based on how it can be exploited and how bad the effect could be. It is a useful common language, and it is generic by design.

What it does not know

• Your context: the same flaw matters more on the system holding customer data than on an isolated test server.
• Exposure: a flaw reachable from the internet is not the same as one needing local access.
• Chains: two "medium" findings can combine into something serious.
• Real-world use: whether the weakness is actively exploited in the wild.

A practical approach

Start from the score, then adjust for your business impact and exposure, and record why. When a report gives you both a score and a tester's comment on real-world impact, read the comment first.