When I joined Red Hat in 2019, one of the first blogs that I read was titled “Why CVSS does not equal risk: How to think about risk in your environment”. In summary, it explains why CVSS ≠ Risk: Common Vulnerability Scoring System (CVSS) scores measure the severity of vulnerabilities but don’t capture the unique risks they pose to specific environments. Risk is context-dependent, and organizations must consider factors like exploitability, impact and mitigation to tailor vulnerability management to their needs.Today, many organizations are still measuring the security of their environm
This article has been indexed from Red Hat Security