hard20 pts · first answer countsrisk-managementcyber-risk

CVSS score vs risk

A vulnerability has CVSS 9.8 but sits on an isolated test server with no data. Another has CVSS 6.5 on an internet-facing payment API. Which statement is correct?

A.CVSS 9.8 is always the higher business risk of the twoB.CVSS rates severity; risk also needs exposure and asset valueC.CVSS already includes the business value of the assetD.Both carry the same risk because both have a score

Discussion 0

Join free to post in the discussion.

CVSS score vs risk

Discussion 0

Related questions