BEYOND VULNERABILITY PRIORITIZATION: UNLOCKING THE COMPREHENSIVE POTENTIAL OF CVSS FOR HOLISTIC CYBERSECURITY

The Common Vulnerability Scoring System (CVSS) is primarily known as a tool for prioritizing vulnerabilities in patch management. However, CVSS has broader applications, offering a standardized framework to describe the nuanced characteristics of vulnerabilities that can benefit various aspects of cybersecurity. This paper reexamines CVSS by highlighting its use as a common language across security operations, its predictive value in risk models, and its applications in software development. We argue that CVSS is underutilized and frequently misapplied, advocating for a strategic approach that leverages its descriptive power to enhance cybersecurity decision-making beyond simple scoring.