ATT&CK Analysis vs CVSS: what changes for connected device teams?

TL;DR: CVSS-based vulnerability queues systematically mis-rank risk in IoT, OT, IoMT, and IT environments because severity scores ignore device context, exploitability, and network topology, according to Asimily. Its ATT&CK Analysis prioritises only vulnerabilities with a realistic path to exploitation, which shifts exposure management from abstract scoring to environment-specific decision-making.

Editorial analysis by NHI Mgmt Group, based on content published by Asimily: “ATT&CK Analysis: How Asimily Determines Which Vulnerabilities Require Action”.

Key questions

Q: Why does CVSS mis-rank vulnerabilities in IoT and OT environments?

A: CVSS measures severity in isolation, but connected-device risk depends on whether the vulnerable asset is reachable, which firmware version is running, and whether the network path enables exploitation.

Q: What breaks when vulnerability prioritisation ignores network topology?

A: The queue becomes misleading.

Q: How should security teams decide which connected devices to remediate first?

A: They should prioritise devices where exploitability is confirmed by the combination of asset profile, firmware version, exploit availability, and network reachability.

Practitioner guidance

• Replace CVSS-only queues with exploitability-based triage Rank connected-device vulnerabilities by device model, firmware version, exploit availability, and network reachability, then suppress findings that lack a realistic attack path.
• Use topology data to drive remediation order Map which devices can actually be reached from likely entry points before assigning work, so the queue reflects operational exposure rather than generic severity.
• Tie segmentation rules to confirmed attack paths Write isolation policies around devices and flows that have demonstrated exploitability in your environment, not around every high-scoring CVE.

Bottom line: Connected-device vulnerability queues fail when severity is treated as a substitute for exploitability.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →