Comment by ozim

Everyone thinks that system is outdated. I don’t think we have any cybersecurity professionals claiming otherwise.

It is in use just because it already is there and to make something new will be tough.

I think we should drop the score entirely. Just give me details and I should be able to make my risk management based on if it is RCE is it local or just info disclosure etc.

Global scoring is something that feels right but in practice it is totally wrong. Biggest damage happens when management that doesn’t understand any of that wants to have excel sheets green.