Common Vulnerability Scoring System

Expanded Definition

Common Vulnerability Scoring System, or CVSS, is a standardised way to express vulnerability severity as a score and vector. In practice, it helps security teams compare findings across tools and time, but it does not replace asset criticality, exposure, exploitability in the wild, or business impact. Current usage is largely based on CVSS v3.1, while some organisations are already evaluating CVSS v4.0 in parallel, so definitions vary across vendors and score interpretation can differ by tooling. For a neutral reference point, practitioners often pair CVSS with external threat intelligence such as CISA cyber threat advisories and internal control priorities. In NHI and agentic AI environments, CVSS is most useful when a vulnerability affects secrets handling, service account permissions, or exposed control planes.

The most common misapplication is treating a high CVSS score as an automatic emergency, which occurs when remediation queues ignore whether the vulnerable asset is internet-facing, privileged, or actually reachable.

Examples and Use Cases

Implementing CVSS rigorously often introduces prioritisation overhead, requiring organisations to weigh scoring consistency against the need for context-rich triage.

• A secrets manager plugin has a high base score, but remediation is accelerated only after confirming it can expose long-lived credentials stored outside the vault, a pattern highlighted in the Ultimate Guide to NHIs.
• A CI/CD dependency flaw scores as medium severity, yet it becomes a top priority when it can alter deployment pipelines and mint or reuse NHI tokens, which aligns with guidance in the Top 10 NHI Issues.
• An exposed API gateway component receives a critical score, but the team still validates whether the attack path reaches production workloads before assigning emergency patch windows.
• A service account management weakness is rated using CVSS, then cross-checked with CIS Controls v8 to decide whether detection, rotation, or privilege reduction is the fastest risk reduction path.
• An identity platform flaw affecting tenant access is triaged with CVSS alongside exploit activity and architectural exposure, especially when reviewing cases like the Microsoft Entra ID Flaw.

Why It Matters in NHI Security

CVSS matters because NHI compromise rarely begins with a dramatic platform collapse; it often starts with a mis-scored vulnerability on a secret store, agent runtime, or automation path that later becomes a foothold for privilege escalation. NHI Mgmt Group reports that 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, which is why severity scoring must be connected to identity context rather than treated as a standalone number. A vulnerable component with moderate CVSS can still create severe organisational exposure if it touches long-lived credentials, workload identities, or third-party integrations. Security teams should use CVSS as one input in a broader decision model that also includes secret sprawl, privilege depth, and blast radius. The same applies when reviewing vulnerability trends in the ENISA Threat Landscape, where exploitation context often matters more than the abstract score. Organisations typically encounter the real cost of CVSS misprioritisation only after a vulnerability is exploited and an NHI is used to move laterally, at which point the score becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Who should own governance for agentic AI vulnerability scoring?
• How can organisations make vulnerability scoring auditable and actionable?
• When does vulnerability scoring stop being useful for prioritisation?
• What do security teams get wrong about runtime vulnerability scoring?