[Samhith]

I’m not saying throw it out, but relying solely on CVSS can be misleading. For example, take a high-severity vulnerability in a system that’s isolated and heavily firewalled. It’s less urgent than a medium-severity issue in a core business application.

[Samhith]

That’s true but it’s not the full picture. CVSS scores lacks context. A high CVSS score doesn’t necessarily mean the vulnerability poses a significant risk in every environment. Misprioritizing based on scores alone can waste resources.

[Author]

Posts