Comment by AnneTrotter

Scores are still useful - individual context is always still on the enterprise to determine. But scores could be replaced with a list of capabilities the vuln modifies instead, for nuance. Thing is that there's a HUGE structure of scanning and reporting built on top of the CVE scores. It's load bearing for a lot of stuff.