"The 9.8 That Was Never About You"

Jessy Lang: Welcome back to Security Dialogues. I'm Jessy, and this is episode eight. Just the two of them tonight. Marcus spent last weekend on an emergency call that, by Monday, turned out to be almost nothing. A scanner flagged a 9.8 in a component one of his clients runs. Nine point eight out of ten. The kind of number that gets a CTO calling on a Saturday morning. By the time Marcus actually traced how the thing was deployed, the affected code path wasn't reachable from anywhere an attacker could stand.

Marcus Hale: It cost us a weekend, four engineers, and one very tense call with a customer who'd seen the same CVE on a news site before I'd even opened the ticket.

Tess Calder: And somewhere in the same report queue, I'd bet, there's a five- point-something nobody's touched.

Marcus Hale: Five point three. Still open. Sitting on a service that's directly internet-facing, no authentication in front of it, and processes customer data. Nobody's called anyone about that one.

Jessy Lang: Marcus, Tess, this is where tonight starts.

— I. The Weekend the 9.8 Ruined —

Tess Calder: Walk me through Saturday. What actually happened, start to finish.

Marcus Hale: A dependency scanner flags a new CVE against a library we use. Critical, CVSS nine point eight. The scanner doesn't know anything about how we use the library, it just matches a version string. It fires an alert, the alert hits a Slack channel with forty people in it, and by the time I wake up there are six messages asking if we're compromised. Nobody's compromised. Nobody's even confirmed the vulnerable code path is in scope. But nine point eight reads as an emergency to everyone who sees it, so by nine in the morning I've got a war room.

Tess Calder: And when you actually looked.

Marcus Hale: The vulnerable function lives behind a feature flag we've had permanently disabled since launch. It's not that we're protected by some clever mitigation. The code path simply never executes in our deployment. It could be a nine point eight on Mars for all it affects us. It took me four hours to establish that, on a Saturday, with a war room still open the entire time.

Tess Calder: Four hours to prove a number was talking about a system that isn't yours.

Marcus Hale: Four hours, on a weekend, to answer a question the score itself was never built to answer.

— II. What CVSS Actually Measures —

Tess Calder: So let's be precise about what that nine point eight actually claims, because I don't think most of the people in that Slack channel could tell you.

Marcus Hale: CVSS, the Common Vulnerability Scoring System, has more than one number in it, but the Base Score is the one everyone means when they just say "CVSS." It describes the vulnerability itself. How is it reached, over a network or only locally. How complex is the attack. Does it need privileges first. Does it need a user to click something. Does it stay contained or spread across a trust boundary. And then the damage: confidentiality, integrity, availability, each rated by how bad a successful exploit would be. Run all of that through the formula and you get one number.

Tess Calder: And crucially, none of those questions is "does this affect you."

Marcus Hale: Not one. The Base Score is deliberately written to be the same number for every installation of that library on Earth. That's the entire design goal. A vendor, a researcher, whoever discloses the vulnerability, computes it once, and it travels with the CVE forever, identical whether you're running the vulnerable code path in production or you disabled it three years ago and forgot it existed.

Tess Calder: Which is a perfectly reasonable thing to compute. It's just not the thing anyone in that Slack channel thought they were looking at.

Marcus Hale: They thought they were looking at their own risk. They were looking at everyone's risk, averaged into a single portable number, with their specific deployment nowhere in the calculation.

— III. Borrowed Severity —

Marcus Hale: I want to name this properly, because we've been circling a version of it since episode two. Call it borrowed severity. A number computed somewhere else, about a hypothetical average deployment that doesn't exist, picked up and treated as a verdict about your specific system.

Tess Calder: Same shape as borrowed certainty, the risk-matrix score from back then. That one multiplied a real measurement by a guess and handed you one confident number. This one takes a number computed for nobody in particular and hands it to you as if it had your name on it.

Marcus Hale: Different mechanism, same result. Somebody else's arithmetic wearing your organisation's letterhead. And it works on people precisely because it looks so rigorous. Two decimal places. A published formula. Nobody in that Slack channel is being irrational by panicking at nine point eight, they're trusting a number that's dressed exactly like the kind of number you should trust.

Tess Calder: The dressing is doing the persuading, not the content.

Marcus Hale: The dressing is the entire persuasion. If that scanner alert had just said "a library you use has a bug, severity unknown," you would have investigated calmly on Monday. Because it said nine point eight, you got a war room on Saturday.

— IV. The Score Nobody Fills In —

Tess Calder: CVSS has more than one number, though. I've seen the spec. There's a piece that's supposed to fix exactly this.

Marcus Hale: The Environmental Score. It lets you take the Base vector and adjust it for your reality; whether the vulnerable configuration is even present, whether your mitigations change the attack complexity, and then, the part that actually matters most, you set three values yourself: how much does confidentiality, integrity, and availability of this specific asset matter to you. Low, medium, high. Rate that honestly and run the formula again, and the nine point eight can become a two point one, or it can become an eleven if the scale went that high, depending on what the asset actually is to you.

Tess Calder: So the tool to answer the actual question already exists. Who's using it?

Marcus Hale: Almost nobody. I have looked at hundreds of vulnerability reports across a dozen clients this year. I could count on one hand the number of times I've seen a filled-in Environmental Score next to the Base Score it's supposed to sit beside.

Tess Calder: Environmental isn't the only other number, either. I keep seeing EPSS and KEV sitting next to CVSS entries and nobody's ever actually explained how they're different from each other, or from what we just described.

Marcus Hale: They're not even trying to answer the same question, which is exactly why lining them up matters. Temporal sits inside CVSS itself, it's the Base vector adjusted for where the vulnerability actually is in its lifecycle: is there public exploit code yet, is it still theoretical, has it been weaponized into an actual toolkit, has the vendor shipped a fix, how confident is the report itself. Same formula family as Base, just tracking reality as it changes instead of freezing the day of disclosure.

Tess Calder: So Temporal still answers "how bad is this vulnerability." Just a more current version of that same question.

Marcus Hale: Still the same question, updated. EPSS, the Exploit Prediction Scoring System, is a completely different animal. It's not part of CVSS at all. It's a separate model, maintained by the same organisation, that predicts the probability a given CVE gets exploited somewhere in the next thirty days, trained on actual observed exploitation data across the whole internet: scanning traffic, exploit kit adoption, chatter. It outputs a percentage, not a severity.

Tess Calder: That's the honest version of the likelihood half of the equation we tore apart back in episode two. Somebody actually built the real number where we were multiplying a fact by a guess.

Marcus Hale: It's the closest thing the industry has to that honest number, and it can disagree wildly with CVSS. I've seen a seven point five sitting under one percent on EPSS, essentially never going to be used against anyone. I've seen a five point four sitting above ninety percent, because it's trivial to automate and every scanner on the internet is already trying it.

Tess Calder: And KEV.

Marcus Hale: KEV, Known Exploited Vulnerabilities, isn't a score at all. It's not predicting anything. It's CISA's catalog of vulnerabilities they have direct evidence were actually used in a real attack. Not "could be." Was. That's the maximum case, in the most literal sense there is: every other number on this list is estimating something, and KEV is just telling you it already happened, somewhere, to someone.

Tess Calder: So there are four different questions riding on the same CVE, and the only one that ever gets read out loud in a war room is the one that was never about the war room's actual system.

— V. Why the Homework Never Gets Done —

Tess Calder: Why not, though? If the fix is sitting right there in the spec, why does nobody do it?

Marcus Hale: Because filling it in honestly requires an answer to a question most organisations have never actually settled: how much does this specific asset matter. Not in general. Specifically. Which system holds the data that would actually hurt you if it leaked. Which service, if it went down for an hour, costs real money versus which one nobody would notice. That's not a security question, it's an inventory of your own priorities, and most places have never sat down and written it out per asset.

Tess Calder: The same inventory problem we keep running into. Nobody has the list.

Marcus Hale: The exact same shape. You can't score an asset's importance to you if nobody's ever decided what that importance is. And there's a second reason, a more uncomfortable one. Publishing a lowered Environmental Score feels politically dangerous. If I take a nine point eight and turn it into a two point one on the record, and I'm wrong, that document has my name on a vulnerability I called low risk right before it got exploited. Leaving the Base Score untouched costs me nothing personally. It was never my number to begin with.

Tess Calder: So the incentive runs entirely one direction. Keep the borrowed number, because correcting it is unpaid work that only creates personal risk if you get it wrong, and creates no credit at all if you get it right.

Marcus Hale: Nobody ever got promoted for correctly downgrading a vulnerability that then, predictably, did nothing.

— VI. Both Sides Lean on the Scale —

Tess Calder: It's not only the people receiving the score who have an incentive, either. I've watched the people assigning it lean on the scale too, in both directions.

Marcus Hale: Say more.

Tess Calder: A vendor I did an engagement for once pushed back hard on a nine point one I'd calculated for a finding, and got it published at six point four instead, by arguing the attack complexity metric up a notch, from low to high, on genuinely thin grounds. Nothing dishonest enough to challenge outright. Just a generous reading of one metric, in the direction that happened to help their public severity number.

Marcus Hale: And I've seen the opposite, from researchers. A self-reported nine point eight that, when I actually walked the attack chain, needed three separate conditions to align that the report never mentioned. Score it honestly and it drops closer to seven. But a nine point eight gets a name attached to a scarier headline than a seven does, and headlines are currency in that world.

Tess Calder: So the number gets leaned on from both ends before it ever reaches you. Vendors nudging it down to look responsible, some researchers nudging it up to look important, and what lands in your queue is whichever version of that negotiation happened to win.

Marcus Hale: Which is one more reason the number was never a verdict. It was already somebody's argument before you ever saw it.

— VII. Tess's Filter —

Marcus Hale: You read these reports from the other side. What does the Base Score actually mean to you, walking in as the attacker?

Tess Calder: Roughly nothing, honestly, until I've checked reachability myself. I've used a five-point-something with a clean, boring CVSS vector to walk straight into a network, because it happened to sit on something internet- facing with no compensating control anywhere near it. I've walked past a nine point eight without a second look because it lived three network hops behind a segmentation boundary I couldn't cross in the time I had. The score told me nothing about which of those two was actually my way in. Only looking did that.

Marcus Hale: So for you the number is, what, a sorting hint at best.

Tess Calder: A sorting hint I don't even fully trust, because the Base Score doesn't know your segmentation, your network layout, your authentication in front of the thing, any of it. It knows the vulnerability in the abstract. My job starts exactly where that number runs out.

Marcus Hale: Give me the engagement where that mattered most. The one you actually remember.

Tess Calder: A manufacturing client, two years back. Their whole external report queue was dominated by a nine point eight in a piece of remote- management software, the kind of thing that gets its own dedicated advisory and its own logo. Their security team had spent a month on compensating controls for it. Meanwhile there was an unauthenticated diagnostic endpoint on their factory floor equipment, CVSS five point nine, that nobody had looked at twice because five point nine doesn't get a logo. That endpoint let me pull configuration data that led, three steps later, to full control of a production line. The nine point eight, as it turned out, sat on a management interface that was never exposed outside their VPN in the first place.

Marcus Hale: So the month went to the number with the press coverage, and the actual door was sitting open the entire time, rated at barely above medium.

Tess Calder: A whole month, on the wrong number, while the real one sat in the queue looking unremarkable.

— VIII. When Context Makes It Worse —

Marcus Hale: I want to be fair here, because everything we've said so far makes it sound like context always shrinks the number. It doesn't. I had a client, a medical device manufacturer, with a moderate CVSS, somewhere around five point four, on a component controlling dosage calibration. Nothing about the Base vector looked alarming. Local access required, no network exposure listed, limited impact rated.

Tess Calder: But the Availability Requirement on that specific asset.

Marcus Hale: Was about as high as it gets, because "availability" for a dosage-calibration component isn't an inconvenience if it fails, it's a patient safety event. Run the Environmental Score honestly and that five point four becomes something closer to a nine. Higher than the Base Score ever suggested, because the thing the Base Score treats as a generic damage rating was, for this specific device, about as serious as damage gets.

Tess Calder: So borrowed severity doesn't only make things look scarier than they are. It can just as easily hide the one that should have scared you.

Marcus Hale: Which is the actual argument for doing the homework. It's not a tool for talking yourself out of patching. Half the time I've seen it done honestly, it went the other way; a number everyone had been ignoring turned out to be the one that mattered most for that specific deployment.

— IX. Applies vs. Matters —

Tess Calder: There's a piece of this I keep hearing conflated, and I want to pull it apart properly. "Does this even apply to us" and "how much does it matter if it does" sound like the same question. They aren't.

Marcus Hale: They're genuinely two different documents, even. Whether a CVE applies to your specific product and configuration at all, that's what a VEX statement answers: affected, not affected, fix available, under investigation. A vendor can look at a nine point eight against their product and publish VEX saying, formally, "not affected," because the vulnerable function is compiled out of their build. That's not scoring severity lower. That's saying the vulnerability doesn't exist for you at all.

Tess Calder: Which is a different claim from the Environmental Score entirely.

Marcus Hale: Completely different question. The Environmental Score assumes the vulnerability does apply to you, and asks how much that should worry you given what this specific asset is. VEX answers "does this apply." Environmental scoring answers "how much does it matter, given that it does." My Saturday war room was actually a VEX question in disguise, the code path wasn't reachable at all, full stop, not merely downgraded. The dosage- calibration case was an Environmental Score question, the vulnerability absolutely applied, the only question was how severely.

Tess Calder: Two different pieces of paperwork, both usually missing, both mistaken for the same missing piece of paperwork when people notice the gap at all.

— X. How the Client Actually Does It —

Tess Calder: You mentioned dosage calibration like you'd seen this done properly somewhere. Who actually does the homework in advance instead of during a war room?

Marcus Hale: That same medical device client, as it happens, though it took the calibration incident to get them there. They built an asset tier list ahead of time, not per vulnerability, once, covering every system they run: which ones hold what kind of data, which ones are safety-relevant, which ones are genuinely disposable. Three tiers, nothing exotic. When a new CVE lands against something in tier one, the Confidentiality, Integrity, and Availability Requirements are already decided. Nobody debates them at two in the morning. They just plug the Base vector into a formula that already knows what this asset is worth to them.

Tess Calder: So the actual work isn't scoring the vulnerability faster. It's having already decided what your own systems are worth, long before any specific CVE shows up.

Marcus Hale: Which is exactly the inventory pattern again, one more time, in a new costume. An SBOM tells you what's in your software. A crypto inventory tells you what protects your data. An asset tier list tells you what your own systems are actually worth to you. None of them help on the day something breaks if you didn't already have them before.

Tess Calder: Walk me through the actual mechanics, though, because "asset tier list" can mean anything from a real system to a spreadsheet nobody opens twice.

Marcus Hale: Three things, same as usual. First, every system gets tagged, once, at onboarding, not retroactively hunted down later; new service goes live, it doesn't get a name in production until someone's assigned it a tier. Second, the tier definitions themselves are written down in plain language a non-engineer can apply consistently, not left to individual judgment call each time, which is where most of these efforts quietly fall apart. Third, and this is the one that actually makes triage fast, the CIA requirements per tier are pre-computed into the Environmental Score formula, so scoring a new CVE against a tier-one asset is a lookup, not a debate.

Tess Calder: So the argument happens exactly once, when the tiers get defined, instead of once per vulnerability for the rest of the company's existence.

Marcus Hale: That's the entire trade. Front-load the disagreement, once, while nobody's panicking about a specific CVE, so that every future Saturday morning is a lookup instead of a meeting.

— XI. What It Costs —

Tess Calder: What did building the tier list actually cost them? I don't want this to sound free either.

Marcus Hale: About six weeks, spread across engineering leads, compliance, and one very patient facilitator getting department heads to agree on what "critical" means across teams that had never had to agree on that before. That's the expensive part, honestly, not the technical scoring. Getting a hospital-device team and a billing-systems team to argue their way to a shared definition of "high availability requirement" took longer than building the spreadsheet that stores the answer.

Tess Calder: And the payoff.

Marcus Hale: The next nine point eight that landed on them, three months later, took twenty minutes to triage instead of a weekend. Pull the tier, plug in the pre-agreed values, get a real number, done before lunch. No war room. The six weeks bought them every single incident after it, not just the one that happened to prompt the project.

Tess Calder: Boring and early beating expensive and late, one more time.

Marcus Hale: I don't think this show is ever going to stop finding new versions of that sentence.

— XII. Two Kinds of Wrong —

Marcus Hale: Last episode, Priya was dealing with a report that sounded completely certain about a vulnerability that was never there at all. Confabulated urgency, a tool inventing specifics with total confidence about a problem that didn't exist.

Tess Calder: This is the opposite failure, almost precisely. The vulnerability in my Saturday number was completely real. Real CVE, real bug, correctly computed nine point eight. The urgency wasn't invented. It just wasn't computed about you.

Marcus Hale: Confabulated urgency lies about whether there's anything there at all. Borrowed severity tells the truth about something real and then lets you assume, wrongly, that the truth was about your system in particular.

Tess Calder: Which might be the more dangerous failure of the two, honestly. A fabricated report eventually falls apart under scrutiny, because none of it holds up. A borrowed score never falls apart, because every part of it is accurate. It's accurate about someone else's deployment, and nobody thought to check whose.

Marcus Hale: The fix isn't distrusting CVSS. The Base Score does exactly what it was built to do, and does it well; it just wasn't built to answer the question everyone keeps asking it. The fix is the same one we keep landing on, episode after episode. Decide what your own systems are worth before the number arrives, so that when it does, you're the one answering the question, not the score.

Tess Calder: A nine point eight that was never about you is just a fact about somebody else's Saturday. It only becomes a fact about yours if you never bothered to ask.

— Outro —

Jessy Lang: Borrowed severity: a real number, correctly computed, about a system that almost certainly isn't yours, worn as if it were. I liked that this one cuts both ways; sometimes the honest number is lower than the one that ruined someone's weekend, and sometimes, quietly, it's a lot higher than anyone had noticed. If a Base Score has ever cost you a weekend for nothing, or you've built the tier list and watched the next war room shrink to twenty minutes, tell us. We read everything. Subscribe wherever you're listening to this, and leave us a rating if you've ever seen two decimal places talk a room full of adults into a Saturday morning call. Until then.