How to Interpret CVSS, VPR, and RWRS Scores

Managing vulnerabilities effectively requires a solid understanding of vulnerability scoring systems, which help organisations prioritise remediation efforts. Scores such as the Common Vulnerability Scoring System (CVSS), Vulnerability Priority Rating (VPR), and Real World Risk Score (RWRS) provide valuable insights into the severity, exploitability, and real-world impact of vulnerabilities. Each score serves a distinct purpose in vulnerability management, and using them together enables organisations to make informed risk management decisions.

This guide explains how to interpret and use CVSS, VPR, and RWRS scores to assess, prioritise, and mitigate security risks.

1. What is the Common Vulnerability Scoring System (CVSS)?

The Common Vulnerability Scoring System (CVSS) is an industry-standard framework for measuring the severity of security vulnerabilities. Developed by the Forum of Incident Response and Security Teams (FIRST), CVSS provides a numerical score between 0.0 and 10.0, with higher scores indicating more severe vulnerabilities.

1.1 Components of the CVSS Score

CVSS scores are calculated based on three metric groups:

1. Base Score: Measures the intrinsic characteristics of the vulnerability, which remain constant over time and across environments.

   • Includes metrics such as Attack Vector (AV), Attack Complexity (AC), and Impact on confidentiality, integrity, and availability.

2. Temporal Score: Adjusts the base score to account for factors that change over time, such as the availability of a patch or exploit code.

3. Environmental Score: Customises the score based on the specific organisation's environment, including the importance of affected systems and the potential business impact.

1.2 CVSS Score Ranges and Severity Ratings

• 0.0: None (No impact)

• 0.1 - 3.9: Low severity

• 4.0 - 6.9: Medium severity

• 7.0 - 8.9: High severity

• 9.0 - 10.0: Critical severity

1.3 How to Use CVSS Scores

CVSS provides a consistent method for comparing vulnerabilities across different systems and applications. However, it has limitations, including a lack of real-world context. For example, a vulnerability with a high CVSS score may not be actively exploited, making it less urgent to remediate than a lower-scoring but actively exploited vulnerability.

Best Practices:

• Use CVSS as an initial indicator of vulnerability severity.

• Consider additional factors, such as exploitability and business impact, to refine prioritisation.

2. What is the Vulnerability Priority Rating (VPR)?

The Vulnerability Priority Rating (VPR) is a dynamic scoring system that builds on CVSS by incorporating real-time threat intelligence. Developed by Tenable, VPR provides a score between 0 and 10 that reflects the likelihood of a vulnerability being exploited and the urgency of remediation.

2.1 Factors Influencing VPR Scores

VPR scores are calculated based on several factors, including:

1. Threat Intelligence: Data on whether the vulnerability is being actively exploited in the wild.

2. Exploit Availability: Information on whether exploit code is publicly available.

3. Vulnerability Age: Older vulnerabilities with no history of exploitation may have lower priority.

4. Severity: The underlying CVSS score is factored into the calculation.

2.2 Benefits of VPR

• Dynamic Prioritisation: VPR accounts for the changing threat landscape, helping organisations focus on vulnerabilities with a higher likelihood of exploitation.

• Real-Time Insights: Continuous updates based on the latest threat intelligence.

Example:
A vulnerability with a CVSS score of 9.0 but no active exploitation may have a VPR score of 6.0, while a vulnerability with a CVSS score of 6.5 that is being actively exploited may have a VPR score of 9.0.

2.3 How to Use VPR Scores

• Prioritise vulnerabilities with high VPR scores, as these are more likely to be exploited in real-world attacks.

• Use VPR in combination with CVSS to balance severity and exploitability.

3. What is the Real World Risk Score (RWRS)?

The Real World Risk Score (RWRS) is a proprietary scoring system that combines vulnerability data, threat intelligence, and environmental factors to provide a more comprehensive assessment of risk. RWRS aims to address the limitations of both CVSS and VPR by factoring in an organisation's specific business context and security priorities.

3.1 Components of the RWRS

The RWRS is calculated using multiple data sources, including:

1. Vulnerability Severity: Derived from CVSS and similar frameworks.

2. Exploit Activity: Data on whether the vulnerability is currently being exploited in the wild.

3. Asset Criticality: Importance of the affected system to business operations.

4. Compensating Controls: Presence of security measures that reduce the risk (e.g., firewalls, intrusion prevention systems).

3.2 Benefits of RWRS

• Customised Risk Assessment: RWRS provides a tailored risk score that reflects the organisation's unique environment and priorities.

• Improved Decision-Making: SOC analysts can prioritise vulnerabilities based on both technical severity and business impact.

Example:
A critical vulnerability on a low-priority asset may have a lower RWRS than a medium-severity vulnerability affecting a business-critical application.

3.3 How to Use RWRS

• Incorporate RWRS into risk management workflows to prioritise vulnerabilities that pose the greatest risk to business operations.

• Use RWRS alongside CVSS and VPR to gain a holistic view of vulnerability risk.

4. Comparing CVSS, VPR, and RWRS

5. Best Practices for Using CVSS, VPR, and RWRS

1. Combine Scores: Use CVSS, VPR, and RWRS together to balance technical severity, exploitability, and business impact.

2. Automate Prioritisation: Integrate scoring systems with vulnerability management tools to automate prioritisation and reporting.

3. Regularly Update Data: Ensure that scoring systems are updated with the latest threat intelligence and vulnerability data.

4. Engage Stakeholders: Collaborate with business leaders, IT teams, and security analysts to align vulnerability management with organisational priorities.

6. Conclusion

Understanding and interpreting CVSS, VPR, and RWRS scores is essential for effective vulnerability management. By using these scoring systems together, organisations can prioritise vulnerabilities based on severity, exploitability, and business impact, reducing their overall risk exposure. A proactive, data-driven approach to vulnerability management helps protect critical assets, ensure compliance, and support business continuity.

For expert guidance on vulnerability assessment, threat intelligence integration, and SOC operations, contact our cybersecurity specialists today.

Would you like additional resources, such as scoring templates, vulnerability management playbooks, or case studies? Let us know!