There is a recurring moment of panic in many IT departments: the release of a new security bulletin with a vulnerability rated CVSS 9.8 (Critical). Immediately, everything stops, and the rush to patch begins. But as an IT Security Manager, the question I ask is different: does that vulnerability truly represent a business risk?

1. The CVSS score is not the Risk

The Common Vulnerability Scoring System (CVSS) measures the technical severity of a flaw. It tells us how easy it is to exploit and what technical impact it has on the isolated system. It tells us nothing about the business context. Risk, by definition, is the intersection between the Probability of a threat exploiting a vulnerability and the Impact (which we calculated in the BIA) that this event would have on the asset.

2. The Power of Context

Let's look at a practical example. We have the same CVSS 9.8 vulnerability (Remote Code Execution) on two different machines:

• Server A: An isolated test machine in a VLAN with no internet access and no real data.
• Server B: The internet-facing web server that handles the company's e-commerce.

The vulnerability is identical, but the Risk is vastly different. Stopping production to urgently patch Server A is a managerial mistake. The risk on Server A is low, almost nil. The risk on Server B is extreme and requires immediate action (Risk Mitigation).

3. The Risk Matrix for Prioritization

Mature security management does not aim to resolve all vulnerabilities (it's impossible and costly). It aims to prioritize. Using data from the Business Impact Assessment, we can map discovered vulnerabilities onto a Risk Matrix, focusing budget and sysadmin time only on the flaws that threaten critical processes or sensitive data. The rest can wait for the normal maintenance window or, in extreme cases, be handled via Risk Acceptance.

Series Index: The Risk Matrix Series

• Ep. 1: The Risk Matrix Series - From BIA to the Mathematics of Risk (EV, ARO, ALE)
• Ep. 2: The Risk Matrix Series - Vulnerability vs. Risk: Why a CVSS 9.8 isn't always a Business Emergency [You are here]
• Ep. 3: The Risk Matrix Series - Governing Risk: Translating Metrics into ISO 27001 and NIS 2 Compliance
• Ep. 4: The Risk Matrix Series - Third-Party Risk: How to Manage (and Transfer) IT Vendor Risk
• Ep. 5: The Risk Matrix Series - Beyond Mitigation: DFIR, & Business Continuity, and the Art of Surviving