CVSS in OT: why severity scores miss operational risk

TL;DR: CVSS alone can overstate or understate OT risk because a 9.8 on a production HMI is not the same as a 9.8 on a workstation, according to TXOne Networks, and VSAR adds operational context, exploitability, and live threat telemetry to separate urgent vulnerabilities from deferrable ones. The scoring problem is not visibility, it is prioritisation under production constraints.

Editorial analysis by NHI Mgmt Group, based on content published by TXOne Networks: “VSAR: Why OT Vulnerability Scoring Needs Operational Context”.

By the numbers:

• 48% of vulnerabilities found in OT/IoT environments in H2 2025 were rated Critical or High severity.
• Only about 4% of ICS vulnerabilities are actively exploited at the time of disclosure.
• The median time to weaponization is 24 days.

Key questions

Q: What breaks when OT teams rely on CVSS alone for prioritisation?

A: CVSS alone breaks the link between technical severity and operational consequence.

Q: Why do high-severity OT vulnerabilities often fail to become immediate risk?

A: Many OT vulnerabilities are hard to exploit, hard to reach, or slow to weaponize in practice.

Q: What are the signs that OT vulnerability triage is failing?

A: Common signs include long lists of critical findings with no remediation order, repeated arguments between security and operations, and tickets that omit asset role or production impact.

Practitioner guidance

• Adopt context-weighted remediation triage Rank OT vulnerabilities using exploitability, asset exposure, production criticality, and maintenance feasibility together rather than by CVSS alone.
• Separate patchable from mitigable findings Create distinct queues for immediate patch, compensating control, and deferred remediation so operations can approve realistic next steps.
• Attach production context to every ticket Record which line, system, or process each vulnerability affects so remediation conversations stay tied to business impact rather than abstract severity.

Bottom line: OT vulnerability management fails when severity numbers are treated as the whole story, because production context changes what an alert actually means.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →