Why is CVSS not enough for prioritization?
CVSS describes vulnerability attributes in isolation—it does not include your exposure, asset criticality, controls, or threat activity required for operational risk prioritization.
Why is CVSS not enough for prioritization?
Short answer
CVSS standardizes vulnerability attributes—not your exposure, asset role, compensating controls, or active threat context. Use CVSS as input, not as the final rank.
Explanation
Full treatment: Why Severity Alone Is Insufficient (KID-CON-0034).
Also see Context Matters More Than Severity (KID-CON-0003).
Related
- Risk Prioritization in Practice —
KID-CON-0031