COMMON MISTAKES IN USING CVSS

Summary from the TLDR InfoSec newsletter

Don't rely solely on CVSS scores for prioritizing vulnerabilities, as only 17% of critical ones are exploited, while attackers target lower scores. Organizations should implement Risk-Based Vulnerability Management (RBVM) that includes threat intelligence, asset importance, business context, and metrics like EPSS. Research shows EPSS prioritization targets 3% of vulnerabilities with 65% effectiveness, unlike CVSS, which requires 57% coverage for similar results, with only 4% effectiveness.