You can compute it, but it means little. CVSS is an ordinal severity rating, not a measure that adds up. An average of base scores blends different kinds of findings, hides the dangerous few and ignores context. Chart counts by context band and time to fix instead of a mean score.
What CVSS is designed to do
FIRST publishes CVSS. Its v4.0 user guide states that base scores measure the severity of a vulnerability and should not be used alone to assess risk. It also recommends labelling scores by the metric groups used: CVSS-B for base, CVSS-BT with threat metrics, CVSS-BE with environmental metrics and CVSS-BTE with all three.
That labelling is the first problem for averaging. Public databases usually supply base scores only, so a dashboard that averages them is averaging CVSS-B values and calling it posture.
Why a mean is the wrong summary
- Not additive. The jump from a 5 to a 7 is not the same amount of danger as 7 to 9. Arithmetic on the scale pretends it is.
- Dilution. One severe, exploited finding among many low ones barely moves the mean. Adding a thousand harmless findings lowers it.
- Mixed populations. Libraries, containers, web code and infrastructure rules score on different habits.
- Version drift. CVSS v3 and v4 scores can describe the same flaw differently, so mixing them in one mean makes the trend partly an artifact of data sources.
- No context. The mean ignores reachability, exploitation and exposure.
What to chart instead
| Instead of | Chart |
|---|---|
| Mean CVSS | Count of open findings per severity band, shown as a stacked trend |
| Maximum CVSS | Count of reachable or exploited findings |
| Mean score per team | Time to fix per severity band |
| Single risk score | Several named measures, each with a definition |
Counts by band keep the distribution visible. Context bands answer the question leadership actually has: how many of these can hurt us now?
Where scores still help
Use the score as a sorting key inside a context band, and as an input to response windows. The EPSS FAQ from FIRST explains a related point: its output is a probability of observed exploitation activity in the next 30 days and is explicitly not a complete risk score. Treat any single number as one input.
Steps to retire the mean score
- Replace the headline average with counts by band and context.
- Label every score shown with its CVSS version and metric groups.
- Keep the old chart for one quarter as a secondary view, so nobody loses continuity.
- Define response windows per band and report performance against them.
- If you must show one number, show the count of findings past their window.
A note on percentile
Percentile based measures, such as an EPSS percentile, say where an item sits in a population, not how likely it is on its own. EPSS notes that because scores skew toward zero, a probability of 0.10 sits around the 95th percentile. Do not confuse the two on a chart.
Safeguard offers SBOM and dependency scanning, reachability analysis and policy gates. You can run a free scan at gold.safeguard.sh/scan.
Quick check
Is a lower average CVSS better?
Not reliably. It can fall just by adding many low findings. Look at counts in the higher bands and at context.
What should we label next to a score?
The CVSS version and metric groups, such as CVSS-B for base only.
Sources
Last reviewed: 19 October 2026.
