Audit severity mapping by checking three things for a sample of findings: which scoring system the number comes from, which source supplied it, and which band cutoffs turn the number into a label. Most mismatches trace back to one of those three being different from what readers assume.
Why labels disagree
The CVSS v3.1 specification defines a qualitative scale: None for 0.0, Low for 0.1 to 3.9, Medium for 4.0 to 6.9, High for 7.0 to 8.9 and Critical for 9.0 to 10.0. The same document says use of these ratings is optional. Tools can therefore use other labels, other cutoffs, or their own scoring entirely. In addition, the OSV schema lets a record carry several severity entries, each with a type such as CVSS v3 or v4 and an optional source such as NVD or the CNA. A dashboard that picks one of them silently has made a choice.
The audit
- Sample. Take twenty findings across severities, with a few from each ecosystem you use.
- Record the raw data. For each, note every score available: type, value, source.
- Record the displayed label. Note what the dashboard shows.
- Reconstruct the rule. Work out which raw value and which cutoffs produce the displayed label. If you cannot, ask the vendor or read the documentation.
- Check consistency. Do two findings with the same raw score always show the same label? Do findings whose raw scores sit in different versions of CVSS get compared as if equal?
- Check precedence. When several sources disagree, which wins, and is that written anywhere?
Table to fill in
| Finding | Score type | Score | Source | Displayed label | Matches spec band? |
|---|---|---|---|---|---|
| Example row | CVSS v3 | filled in | filled in | filled in | yes or no |
Things to look for
- Mixed versions. A score from one CVSS version is not interchangeable with one from another, so a single chart that blends them needs a note.
- Vendor adjusted ratings. A distributor may rate an issue lower or higher than the original score, reflecting how its own build is affected. That is legitimate, but it should be labelled as such.
- Environmental adjustment. Some tools adjust the score to your environment. The spec calls this the Environmental score and describes it as adjusting severity for a specific computing environment. Know whether your dashboard shows base or adjusted values.
- Unrated items. Findings with no score need their own bucket. See how to handle unscored vulnerabilities.
Fix and document
Once you know the rule, write it on the dashboard itself: "Severity is CVSS v3 base score from the advisory's primary source, bands per the CVSS specification." Add a line for the fallback when it is missing. If your tool lets you choose, pick a consistent rule and apply it to history.
Severity is an input to prioritisation, not the decision itself. After the mapping is clean, add exploit evidence and reachability to rank work.
Safeguard does this kind of counting in one place: SBOM and dependency scanning, asset discovery and reachability analysis feed the same inventory, so each number can be traced back to its source. Reachability analysis helps rank findings beyond the raw label. You can try a free scan at gold.safeguard.sh/scan.
Try it yourself
Open the demo and follow one finding from detection to resolution, noting which number on screen changes and which stays put.
Click through it at your own pace, or open it full screen.
Quick check
Are the CVSS bands mandatory?
No. The specification says the qualitative ratings are optional, so tools may differ. Check what yours uses.
Which source should win when scores disagree?
That is your policy decision. Write it down, apply it consistently, and show the source on the finding.
Sources
Last reviewed: 19 October 2026.
