Why CVSS is not enough

Many companies rely on the CVSS score to assess IT security vulnerabilities. This is a common and sensible practice, as the CVSS score provides an initial assessment of the technical severity of a vulnerability.

But what if this is not meaningful enough? The CVSS alone says nothing about how likely a vulnerability really is to be exploited. As a result, there is a danger of wasting valuable resources on theoretical risks while actually critical vulnerabilities go unnoticed.

This is where EPSS and percentiles come into play: they help to prioritize vulnerabilities according to their real threat level. In this blog, you will learn why these factors are crucial and how you can use them to optimize your cyber risk management.

 (Common Vulnerability Scoring System)

A rating system for assessing the technical severity of a vulnerability from 0 to 10, but without taking into account the actual probability of an attack.

(Exploit Prediction Scoring System)

A data-driven model that calculates the probability of a vulnerability being exploited in the next 30 days.

A statistical method for evaluating a vulnerability in comparison to all others. A percentile of 0.84 means that the vulnerability is more dangerous than 84% of all others – it is therefore a kind of “ranking” for better assessment.

Let's compare two vulnerabilities in a real scenario:

Those who only look at the CVSS score would focus on fixing the critical vulnerability first, while neglecting the potentially high risk posed by the moderate vulnerability.

The percentile shows how a vulnerability is classified in comparison to others – de facto a kind of “ranking” for quicker assessment:

Percentile of 0.84 = This vulnerability is more dangerous than 84% of all other vulnerabilities.

Percentile of 0.99999 = This vulnerability belongs to the 0.001% of the most dangerous vulnerabilities – an absolute high risk!

This helps companies to identify the most critical threats and target their resources.

Incorrectly prioritized CVEs cost time and money due to measures for irrelevant vulnerabilities

False positive: A vulnerability is incorrectly classified as critical, even though it does not pose a major risk in practice.

= Cost trap

Incorrectly postponed CVEs are an unnoticed danger for the company

False Negative: An actually dangerous vulnerability is overlooked or classified as harmless.

= Security gap

CVSS assesses the theoretical severity of a vulnerability, but not its real impact. Only when combined with EPSS and percentiles do companies get a realistic picture of which vulnerabilities they should really prioritize.

In the Cyber Risk Management Platform, you benefit from the advantages of intelligent risk assessment:

• Targeted prioritization: fix vulnerabilities with a high probability of attack first.
• Efficient use of resources: Save time and costs by avoiding unnecessary fixes.
• Better protection: Detect and close really dangerous vulnerabilities in good time.