When a security scanner reports a vulnerability, the first thing most people look at is a number — and that number is usually a CVSS score. Yet despite how widely CVSS scores are cited, they remain genuinely misunderstood by developers and even many security teams. This guide explains what CVSS actually measures, how to read the severity bands correctly, and how Shieldome's proprietary Risk Score gives you an at-a-glance picture of your overall attack surface.
What Is CVSS?
The Common Vulnerability Scoring System (CVSS) is an open framework maintained by FIRST (Forum of Incident Response and Security Teams) for communicating the characteristics and severity of software vulnerabilities. The current version — CVSS v3.1 — produces a numerical score between 0.0 and 10.0 based on a set of standardised metrics.
CVSS is not a risk score. It is a severity score. The distinction matters enormously in practice: CVSS measures the worst-case impact of a vulnerability in isolation, without accounting for whether your organisation is actually exposed to it, whether compensating controls exist, or how likely exploitation is in your environment.
The CVSS Severity Bands
CVSS v3.1 defines five severity bands:
| Rating | Score Range | Typical Meaning |
|---|---|---|
| Critical | 9.0 – 10.0 | Remote, unauthenticated exploitation with full system compromise |
| High | 7.0 – 8.9 | Significant impact; may require user interaction or adjacent access |
| Medium | 4.0 – 6.9 | Moderate impact; often requires privileges or specific conditions |
| Low | 0.1 – 3.9 | Limited impact; typically requires local access or chained exploits |
| None | 0.0 | No measurable security impact |
How CVSS Base Scores Are Calculated
The CVSS Base Score is derived from two groups of metrics:
Exploitability Metrics
- Attack Vector (AV) — Network, Adjacent, Local, or Physical. A vulnerability exploitable over the internet scores higher than one requiring physical access.
- Attack Complexity (AC) — Low or High. Exploits that require no special conditions score higher.
- Privileges Required (PR) — None, Low, or High. Unauthenticated attacks score higher.
- User Interaction (UI) — None or Required. Attacks that need no user action score higher.
Impact Metrics
- Confidentiality Impact (C) — None, Low, or High. Can the attacker read sensitive data?
- Integrity Impact (I) — None, Low, or High. Can the attacker modify data?
- Availability Impact (A) — None, Low, or High. Can the attacker cause a denial of service?
A vulnerability with AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — remotely exploitable, no authentication, high impact across all three pillars — will score 10.0. A misconfigured server header revealing version information might score 5.3, placing it solidly in the Medium band.
Common Misinterpretations of CVSS
Security teams regularly make three mistakes when using CVSS scores:
- Treating CVSS as risk: A Critical-rated CVE in a library you don't use is zero risk to you. Conversely, a Medium-rated misconfiguration on your public login page can be your single greatest exposure.
- Patching in CVSS order alone: Prioritising purely by score ignores exploitability in the wild, business context, and whether your architecture is actually reachable by the attack vector.
- Ignoring Temporal and Environmental scores: CVSS has optional modifier layers — Temporal Score (exploit code maturity, patch availability) and Environmental Score (modified impact for your specific context) — that most tools never surface.
How Shieldome Uses Severity Ratings
Shieldome uses a proprietary Risk Score (0–100) that is inspired by CVSS severity bands but designed to reflect your application's total observable attack surface rather than any single CVE entry.
The calculation is straightforward and transparent:
- Each Critical finding contributes 30 points
- Each High finding contributes 15 points
- Each Medium finding contributes 5 points
- Each Low finding contributes 1 point
The total is capped at 100. A score below 40 indicates critical risk — your site has multiple severe weaknesses that an attacker could chain together quickly. A score above 80 indicates a well-hardened site with only minor observations remaining.
Every finding in a Shieldome report maps explicitly to a CVSS equivalent range so you can communicate results to stakeholders who already speak CVSS:
| Shieldome Severity | Equivalent CVSS Range |
|---|---|
| Critical | 9.0 – 10.0 |
| High | 7.0 – 8.9 |
| Medium | 4.0 – 6.9 |
| Low | 0.1 – 3.9 |
This dual-layer reporting means you get an actionable overall health score for your application alongside the industry-standard severity label for each individual finding — no translation required when filing tickets or presenting to leadership.
Practical Prioritisation Using Both Frameworks
The most effective approach combines both perspectives. Start with your Shieldome Risk Score to understand the overall posture. Then, within each severity band, prioritise findings by exploitability: issues that are reachable from the internet without authentication should always be addressed before those requiring local access. Use the CVSS-equivalent labels to align with your organisation's existing SLA policies — most security programmes already have defined remediation timelines tied to CVSS bands.
Frequently Asked Questions
Is a CVSS score the same as a risk score?
No. CVSS measures the technical severity of a vulnerability in isolation. Risk additionally accounts for the likelihood of exploitation in your specific environment, compensating controls, and business impact. A high CVSS score on a system not exposed to the internet may represent lower real-world risk than a medium CVSS score on your public-facing login endpoint.
What CVSS version should I use?
CVSS v3.1 is the current stable standard and is the version referenced by the NVD (National Vulnerability Database) for most CVEs. CVSS v4.0 was published in 2023 and introduces additional granularity for OT/ICS environments. For web application scanning, v3.1 remains the most widely understood and supported version.
Why does Shieldome use its own Risk Score instead of CVSS?
CVSS is designed to score individual CVEs in software libraries. Shieldome scans live web applications and surfaces configuration weaknesses, header misconfigurations, exposed files, and injection indicators — many of which don't map to a published CVE at all. The Shieldome Risk Score aggregates all findings into a single number that reflects the total observable risk on your application at scan time.
How often should I re-scan to keep my risk score accurate?
Application risk changes every time you deploy code, update dependencies, modify infrastructure configuration, or change DNS routing. A weekly automated scan is a reasonable baseline for most production applications. High-traffic or compliance-sensitive applications benefit from scanning after every significant deployment.
Can two applications with the same CVSS score have different real-world risk?
Absolutely. Two applications can each have a single High-severity finding (CVSS 7.5) but differ dramatically in actual exposure. If one application handles payment card data and faces the internet, while the other is an internal tool on a private network, the business impact of exploitation differs by orders of magnitude. This is exactly why contextual scoring — like Shieldome's application-level Risk Score — adds value beyond raw CVSS numbers.
Ready to see your application's Risk Score and get a full CVSS-mapped report? Start your free Shieldome scan today and understand exactly where your most critical exposures lie.