A vulnerability has a CVSS Base score of 9.8. Does that mean it is a 9.8 risk to your organization?
Short answer
No. The CVSS Base score reflects a vulnerability's severity from its intrinsic characteristics; it ignores your environment. Threat and Environmental metrics refine it, and even then the spec positions the result as input to a risk assessment that also weighs factors outside CVSS, such as regulatory impact or asset value. Prioritise using severity plus exploitation evidence, exposure and business context.
Scanners sort by CVSS, so teams drift into treating the number as risk. Interviewers like this question because the distinction drives patch priorities.
What the Base score is
The FIRST specification says the Base score "reflects the severity of a vulnerability according to its intrinsic characteristics." It is computed from properties of the flaw itself, such as attack vector and impact, and is the same for every consumer.
What else exists
Threat metrics "adjust the severity of a vulnerability" based on factors like exploit maturity, and Environmental metrics "further refine the resulting severity score to a specific computing environment." That information is available only to the end consumer, who is encouraged to enrich the Base score to get "a more comprehensive input to risk assessment specific to their organization." Supplemental metrics do not change the final score.
Risk needs more than CVSS
The spec says consumers may use CVSS as input to a vulnerability management process that also considers factors outside CVSS, such as regulatory requirements and reputational impact. In practice that means asset criticality, exposure, compensating controls and exploitation evidence.
Why the distractors are tempting
"Complete risk rating" is how dashboards present it. "Already adjusted for your environment" misunderstands who has environment data.
What interviewers want
"CVSS Base is severity, not risk; add threat, environment and business context before prioritising."
Likely follow-ups
- Which CVSS metric groups let you adapt a score to your environment?
- How do EPSS or the CISA KEV catalogue complement CVSS in prioritisation?
- How would you explain to executives why a 7.5 on an internet-facing crown-jewel system may outrank a 9.8?