← All Terms

Common Vulnerability Scoring System

CVSS

FIRST's open standard for rating the severity of a software vulnerability from 0 to 10, based on how it is exploited and what it affects.

Governance & Risk

The Common Vulnerability Scoring System is the scale most security teams use to rate a flaw. A score from 0 to 10 is built from how the flaw is reached and exploited, what privileges and user action it needs, and what it does to confidentiality, integrity and availability. Version 4.0, published by FIRST in 2023, separates impact on the vulnerable system from impact on systems beyond it.

The base score describes the flaw, and it is meant to be the same wherever the component runs. That makes it comparable across vendors and easy to put in a policy, which is why fix deadlines are usually set by CVSS band. It also means the score ignores the deployment unless someone fills in the environmental metrics, which few programmes do.

For AI agents the gap is wide. The same CVSS 4.3 finding can lead to a wrong answer in a read-only assistant and a payment in an autonomous agent. Treat CVSS as the floor of a priority, and adjust for what the agent can do with the flaw.

Read more on this
Security

Agent-Aware Vulnerability Management Ranks Flaws by What the Agent Can Do

A vulnerability score describes a flaw. It says nothing about the AI agent standing behind it: how freely it acts, what it is allowed to touch, which tools it can call, what it remembers and which business process it runs. Agent-aware vulnerability management adds those five things to exploitability before deciding what to fix first. ISO/IEC 27090:2026, published in October, gives the threat side of the same picture. Here is how the two fit together and how to run it.

Governance & Risk

How AI Agents Turn Low-Rated Security Findings Into a Serious Risk

Security reviews score findings one at a time and assign each to the team that owns the asset. An AI agent connects those assets by design, so three Low findings can add up to one critical path that no team owns. FIRST's CVSS guidance already says how to score chains, and OWASP's agentic guidance says how to break them. Here is how to govern the path as well as the parts.