CVSS 4.0 improves the way organizations communicate vulnerability severity, but a CVSS score is still not a remediation decision. It describes characteristics of a vulnerability; it does not know whether the asset is exposed, exploited, mission-critical, protected by compensating controls, or scheduled for retirement.
What CVSS 4.0 changed
Version 4.0 distinguishes Base, Threat, Environmental, and Supplemental metric groups, improves treatment of attack requirements and impacts to subsequent systems, and supports clearer score nomenclature. The structure encourages consumers to add threat and environmental context rather than repeating a base score as if it were universal risk.
Executive takeaway
Use CVSS as one input in a transparent prioritization model. Combine it with known exploitation, exposure, asset criticality, business impact, control effectiveness, and remediation cost. Preserve the vector and the metric assumptions so decision-makers can understand why a priority changed.
A practical prioritization model
- Technical severity: CVSS 4.0 Base metrics and complete vector.
- Threat: evidence of exploitation, credible targeting, and relevance to the organization.
- Exposure: internet reachability, identity path, network position, and available mitigations.
- Business context: service criticality, data sensitivity, safety, financial and regulatory consequence.
- Remediation context: patch availability, operational risk, compensating controls, and time to safely deploy.
Implementation priorities
- Store the full CVSS vector and source, not only a decimal score.
- Define when Threat and Environmental metrics must be applied and who owns them.
- Integrate authoritative exploitation information and asset/service context.
- Create escalation rules for high-consequence assets even when technical severity is moderate.
- Measure time to risk treatment by priority class and validate that the model predicts important incidents.
Shawn’s perspective
The worst use of CVSS is false precision: sorting thousands of findings by base score and calling the result risk management. CVSS 4.0 is most valuable when it makes assumptions explicit and creates a common language between vulnerability teams, asset owners, and business leaders.