Why do exploit chains matter more than CVSS scores in practice?

CVSS measures individual severity, but attackers operate across connected weaknesses. A low or medium issue can matter more than a high-severity alert if it sits at the base of a chain that leads to secrets, execution, or lateral movement. Practitioners should rank findings by attacker path, not by score alone.

Why This Matters for Security Teams

Exploit chains matter because attackers do not compromise systems one finding at a time. They connect exposure points into a path that ends in execution, secrets access, or lateral movement. A medium-severity misconfiguration can become the critical first step if it unlocks a token, an internal service, or a trust boundary. That is why scoring alone is a weak prioritisation method when the real question is attacker path.

This is especially true in identity-heavy environments where secrets, API keys, and service credentials are the real targets. NHI Management Group has shown how compromised non-human identities can be leveraged in practical intrusion paths, including the patterns discussed in the DeepSeek breach analysis and the broader 52 NHI Breaches Analysis. In parallel, control frameworks such as NIST SP 800-53 Rev 5 Security and Privacy Controls emphasise layered protection, not isolated severity labels.

In practice, many security teams encounter the true impact of a low-score issue only after it has already served as the entry point for a chain that exposed privileged access.

How It Works in Practice

Exploit chains are built from dependencies. An attacker may start with a public-facing flaw, move into a misconfigured storage bucket or internal admin panel, extract credentials, and then use those credentials to reach higher-value systems. Each step may look modest in isolation, but the chain becomes decisive because the attacker is solving for access, not for a CVSS threshold.

That is why practitioners increasingly rank findings by reachability and privilege impact. A vulnerability with a lower score may deserve immediate attention if it is internet-facing, weaponisable, or adjacent to secrets. A high score may be less urgent if it is isolated behind multiple trust barriers and cannot be chained into action. This aligns with current guidance in NIST SP 800-53 Rev 5 Security and Privacy Controls, which pushes teams toward control effectiveness rather than severity labels alone.

• Map attack paths from initial access to crown-jewel assets, including identity, secrets, and execution points.
• Rank issues by exploitability in context, not by score in isolation.
• Include exposed credentials, overbroad trust, and reachable admin interfaces in the same analysis.
• Prioritise fixes that break the chain, especially where one control prevents multiple downstream abuses.

NHIMG research on the DeepSeek breach shows why this matters: once secrets and data stores are exposed, the attacker’s next move is often immediate chaining, not prolonged reconnaissance. These controls tend to break down when organisations score assets without validating whether the issue can actually be chained into privileged access.

Common Variations and Edge Cases

Tighter exploit-chain prioritisation often increases triage overhead, requiring organisations to balance faster remediation of obvious high scores against deeper analysis of multi-step paths. That tradeoff is real, especially in large environments where scanners generate thousands of findings and only a fraction are directly reachable.

The main edge case is when a high-severity vulnerability truly is isolated and cannot be chained into meaningful access. In those cases, score still matters, but it should be interpreted alongside exposure, trust relationships, and the value of the affected asset. Another common exception is cloud and identity abuse: a small secret leak, token exposure, or weak permission boundary can outrank a louder application flaw because it creates immediate access. The fact that exposed credentials can be acted on within minutes, as highlighted in NHIMG research on the DeepSeek breach, illustrates why dwell time is so compressed once a chain begins.

Best practice is evolving toward path-based risk scoring, but there is no universal standard for this yet. Security teams should treat CVSS as a starting point, then layer in reachability, exploit chaining, and business impact before deciding what to fix first.

Related resources from NHI Mgmt Group

• Why does identity matter more when vulnerabilities are discovered faster than they can be patched?
• Why do still-valid secrets matter after public disclosure?
• Why do browser extension risk scores miss the compromises that matter?
• Why do identity controls matter more when exploit development is automated?