Get in touch with us
We at accompio will be happy to help you.
25.08.2026
Not every vulnerability with a high CVSS score automatically poses the greatest risk to a company. Rather, what is decisive is how easily a security gap can actually be exploited and what impact a successful attack would have in the respective corporate context.
Organisations frequently discover more vulnerabilities than their IT teams can remediate in the short term. Simply sorting by the CVSS score is of limited help with prioritisation. For instance, a medium-rated flaw on a publicly accessible web server can be more urgent than a higher-rated vulnerability in an isolated internal system. Practical exploitability and the importance of the affected system determine the order.
In the expert interview, Stefan Kappey, Service Owner for Vulnerability Management at accompio, explains why the CVSS score is merely the starting point. He demonstrates how exploitability and the individual corporate context alter priority, and how Tenable provides additional guidance with the dynamically calculated Vulnerability Priority Rating, or VPR for short.
In the video, Stefan Kappey explains how CVSS, exploitability and enterprise context influence vulnerability prioritisation.
00:06 | Claudia van Veen: Welcome to the accompio focus topic. How should vulnerabilities be prioritised? Are CVSS scores the go-to method, or what other factors count? I'm joined by Stefan Kappey.
00:22 | Claudia van Veen: Stefan, could you briefly introduce yourself and explain how you came to this topic?
00:28 | Stefan Kappey: I have been working with vulnerability management for eight years. During this time, the question of how to prioritise vulnerabilities always comes up. One of the foundations for this is the CVSS scoring system.
00:45 | Claudia van Veen: What exactly is behind CVSS?
00:49 | Stefan Kappey: CVSS stands for Common Vulnerability Scoring System. It is a globally recognised process for assessing vulnerabilities. The technical criticality is expressed on a scale from 0 to 10. Values between 9 and 10 are considered critical.
01:31 | Claudia van Veen: Which dimensions are factored into the score?
01:35 | Stefan Kappey: CVSS distinguishes between Base, Temporal and Environmental metrics. Base describes fixed technical characteristics such as the attack vector. Temporal takes changes over time into account, for example whether an exploit is available. Environmental attempts to incorporate the organisational context.
02:14 | Claudia van Veen: Is the score alone enough for prioritisation?
02:23 | Stefan Kappey: He provides a baseline assessment. In addition, the company context is crucial. What role does the affected system play, where is it located, how can it be accessed, and is it isolated within the network or publicly accessible via the internet?
02:57 | Claudia van Veen: Can you give a practical example for that?
03:00 | Stefan Kappey: A medium-rated vulnerability on a web server can give attackers their initial access to the company. Fixing it can be more urgent than a missing update on a server in the isolated internal network.
03:19 | Claudia van Veen: What role does exploitability play?
03:28 | Stefan Kappey: Exploitability describes whether a vulnerability can be exploited using an existing exploit. If a ready-made program already exists, an attacker can potentially gain access with just a few steps. Without an exploit, significantly more manual work and technical knowledge are required.
04:03 | Claudia van Veen: What needs to be considered regarding public exploits and exploit kits?
04:08 | Stefan Kappey: Exploit kits and frameworks help pentesters and ethical hackers with security assessments. However, the same tools are also available to attackers. This makes building an effective defence more challenging.
04:34 | Claudia van Veen: How can CVSS, exploitability, and corporate context be systematically combined?
04:48 | Stefan Kappey: The CVSS score provides the fundamental technical information. After that, the business context is added. From this combination, the risk for the respective company can be assessed and the next logical step derived.
05:13 | Claudia van Veen: Which tools or processes can support this?
05:19 | Stefan Kappey: There are many solutions. Among others, accompio uses and recommends the suite from Tenable. It can cover different areas and provide a comprehensive view of corporate security. Transparency is crucial, because what I cannot see or know, I cannot protect.
05:49 | Stefan Kappey: This visibility is required in IT structures, cloud and container environments, and, where applicable, in production and OT environments.
06:07 | Claudia van Veen: How does the theoretical assessment become a practical approach?
06:15 | Stefan Kappey: Tools initially create transparency and deliver the CVSS score. Through the organisation's own risk processes, the business impact of each system is added. Only this combination helps to determine the right measures.
06:42 | Claudia van Veen: What special feature does Tenable offer in terms of prioritisation?
06:47 | Stefan Kappey: CVSS is comparatively static. However, the real threat landscape changes dynamically. Tenable therefore supplements this with the Vulnerability Priority Rating, or VPR for short. This metric is recalculated daily, incorporates the CVSS score, and includes further signals regarding the current threat landscape.
07:43 | Claudia van Veen: Why does optimal prioritisation fail in practice?
08:07 | Stefan Kappey: Not every detected vulnerability can be fixed immediately. Companies must take operational constraints into account. It also becomes problematic when relying exclusively on standard processes or individual scores.
08:34 | Claudia van Veen: What role do automation, threat intelligence and AI play?
08:46 | Stefan Kappey: These technologies support both attackers and defenders. They will help with vulnerability management. However, I am not yet convinced that the task can be left entirely to an AI. The experience and technical assessment of experts remain important.
09:24 | Claudia van Veen: How should companies optimally prioritise vulnerabilities?
09:32 | Stefan Kappey: A suitable tool, for example from Tenable, creates the foundation. In addition, clean patching processes are needed so that reliable measures arise from the assessment.
09:48 | Claudia van Veen: Thank you very much, Stefan, and thanks for watching.
The Common Vulnerability Scoring System, or CVSS for short, is an established standard for assessing the technical severity of security vulnerabilities. The resulting score is intended to help organisations assess and compare vulnerabilities consistently in order to achieve a simplified Vulnerability management to enable.
In doing so, CVSS takes into account various characteristics of a vulnerability. These include, for example, the necessary access vector, the required privileges or the impact on the confidentiality, integrity and availability of an affected system.
CVSS 3.x distinguishes between Base, Temporal and Environmental. Base captures fixed technical properties such as the attack vector, required privileges and potential impact. Temporal takes into account developments over time, such as the availability of an exploit. Environmental adapts the rating to the specific IT environment. In CVSS 4.0, Temporal is now called Threat. Added to this is the Supplemental group for further contextual information.
A CVSS score primarily describes the technical severity of a vulnerability. The specific risk to a company cannot be deduced from this alone.
Stefan Kappey gives a vivid example in the interview: a medium-rated vulnerability on a publicly accessible web server can enable attackers to gain initial access to the company. Fixing it may therefore be more urgent than a missing update on an isolated internal system.
In practice, long lists of vulnerabilities quickly accumulate, sorted by their CVSS score. This is precisely where one of the greatest challenges in vulnerability management lies.
The score indicates the technical severity. Determining the priority of measures requires further information on the affected system, accessibility and the current threat landscape.
These include, for example:
This turns a purely technical assessment into a risk-based prioritisation.
A decisive factor is the so-called exploitability. Put simply, it describes how easily a vulnerability can actually be exploited.
Some vulnerabilities exist technically, but are difficult to exploit under realistic conditions. Others develop a high urgency despite a moderate score as soon as a working exploit is publicly available.
Additional information is therefore important for security teams. This includes, for example, publicly available exploits, proof-of-concept code, exploit kits or indications that a vulnerability is already being actively used in attacks.
That means I press the button, wait a few seconds and I have my access.
Stefan Kappey, Service Owner Vulnerability Management at accompio
Besides CVSS and exploitability, the context of the respective company is crucial above all.
One and the same vulnerability can have completely different priorities on two systems. A publicly accessible server with a direct connection to critical company data is to be assessed differently than a comparable system in an isolated network segment.
Business criticality also plays an important role. If a system fails or is compromised, entirely different consequences can arise depending on the area of application.
Effective prioritisation therefore takes into account at least three levels:
Only through the combination of these factors does a reliable picture emerge.
CVSS captures many technical characteristics of a vulnerability. The score remains stable for large parts of its lifecycle. The real threat landscape can change within a short time.
Tenable uses the Vulnerability Priority Rating (VPR) for this purpose. The metric is recalculated daily. It incorporates the CVSS score as well as current information on available exploits, attack activity and other threat signals. According to Tenable, insights from the dark web can also be taken into account. VPR helps security teams to prioritise large volumes of findings more quickly. The assessment of the affected system, existing protective measures and potential consequences remains the responsibility of the company.
Vulnerability management encompasses the identification, assessment, prioritisation and remediation of security vulnerabilities. A complete view of the IT landscape helps to address exploitable vulnerabilities on critical systems first and subsequently verify the success of the measures.
Problems frequently arise when security teams align their priorities too heavily around a single metric.
When sorting purely by CVSS, high scores automatically end up at the top of the list. The reachability of the system, existing security controls, and the importance to business operations are easily overlooked in the process.
Another mistake is a failure to update the assessment. Vulnerability information is constantly changing. What was still considered a theoretical risk yesterday can already become an acute threat today through a publicly available exploit.
A lack of information about one's own IT infrastructure also complicates prioritisation. Anyone who does not know which systems are particularly critical or which assets can be accessed from the internet can only assess risks to a limited extent.
Operational conditions also influence implementation. Updates require testing, maintenance windows and clearly defined patch processes. Security teams should therefore document why a measure is implemented immediately, scheduled or temporarily deferred.
accompio prioritises, together with you, vulnerabilities based on your IT infrastructure and actual risks to business operations.
Robust vulnerability prioritisation combines the CVSS score with exploitability, threat intelligence and the individual corporate context. Dynamic metrics such as Tenable's VPR help to incorporate changes in the threat landscape into the assessment more quickly. The highest urgency is assigned to the vulnerability that poses the greatest risk to the specific company.
Effective vulnerability management creates transparency regarding systems and attack vectors. It makes technical findings comprehensible for security teams and those responsible, and leads to a clear prioritisation for patches and further protective measures.
Stefan Kappey is Service Owner Vulnerability Management at accompio. For eight years, he has been dealing with the assessment and prioritisation of vulnerabilities and supporting companies in translating technical findings into comprehensible measures.
CVSS stands for Common Vulnerability Scoring System and is a standardised method for assessing the technical severity of security vulnerabilities. The score helps companies evaluate vulnerabilities in a comparable way.
The CVSS score provides a technical basis. Exploitability, threat intelligence, asset criticality, reachability and existing protective measures are added for prioritisation.
In simple terms, exploitability describes how realistic and easy it is to exploit a security vulnerability. Publicly available exploits or already observed active exploitation can significantly increase the priority of a weakness.
The impact of a vulnerability depends heavily on which system is affected and what function it fulfils within the company. For example, a business-critical, publicly accessible system can pose a significantly higher risk than an isolated system with the same vulnerability.
A reassessment should be carried out continuously or regularly. New exploits, changed threat landscapes, new systems or changes to the infrastructure can alter the priority of a vulnerability.
CVSS primarily assesses the technical severity of a vulnerability. Tenable’s VPR complements this foundation with current threat intelligence and is recalculated daily. As a result, the priority of a vulnerability can adapt more quickly to new exploits and attack activities.
AI and automation can evaluate large volumes of data and support security teams with pre-selection. For the final prioritisation, experience, knowledge of one's own systems and a technical assessment of the potential consequences are still required.
