Translate the vector into three sentences: who can attack and how, what they need to do it, and what they get. Each CVSS 3.1 metric maps to a phrase, so you can fill in a template instead of improvising. Then add one sentence on what your team will do and by when.
The template
- Sentence one covers who and how. It uses Attack Vector (AV) and Privileges Required (PR).
- Sentence two covers effort. It uses Attack Complexity (AC) and User Interaction (UI).
- Sentence three covers outcome. It uses Scope (S) and the impact trio C, I and A.
| Metric | Phrase to use |
|---|---|
| AV:N | an attacker over the network |
| AV:A | an attacker on the same network segment |
| AV:L | someone with local access |
| AV:P | someone with physical access |
| PR:N | with no account |
| PR:L | with an ordinary account |
| PR:H | with administrative control |
| AC:L | and no special conditions |
| AC:H | and only if certain conditions line up |
| UI:N | without anyone doing anything |
| UI:R | after a user takes some action |
| S:C | and the damage can reach beyond this component |
| C:H, I:H, A:H | read all data, change all data, or take the service down |
| None | no loss of that kind |
Those phrases follow the definitions in the CVSS 3.1 specification: Network means attackers can come from anywhere up to the internet, Low privilege means basic user capabilities, High means administrative-level control, and High impact means total loss or a serious direct consequence.
Worked example one
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Three sentences: "An attacker over the network, with no account, can exploit this. It needs no special conditions and no one has to click anything. They can read all data, change all data and take the service down."
Then your sentence: "We are treating this as urgent and will patch within the agreed window."
Worked example two
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Three sentences: "An attacker over the network would need administrative control first. After that it needs no special conditions or clicks. They could read and change some data, but not take the service down."
Then yours: "Only a small number of people hold that access, so we will fix it in the normal cycle."
What to leave out
- The number. A score invites a debate about 6.9 versus 7.0. The bands are a convention, and the specification says the base score reflects intrinsic characteristics under a reasonable worst case.
- Metric abbreviations. Keep AV and PR in your notes, not your sentences.
- Alarm words. Say what the attacker can do, not how dangerous it sounds.
What to add
The vector describes the flaw in general. Your manager needs to know about your system. Add one of these, as true:
- "We run the affected component, and here is where."
- "We have the package but our code does not call the vulnerable function."
- "It is reachable only from our internal network."
The specification itself says the base score should be supplemented with temporal and environmental information, and that other factors outside CVSS can inform the remediation decision. Your fourth sentence is that supplement.
When the vector is version 4.0
A vector starting with CVSS:4.0/ has Attack Requirements and separate impact fields for the vulnerable system and subsequent systems. Use the same template, and add "and it only works if this deployment condition is present" for AT:P.
Check the output
Read your three sentences aloud. If a manager would ask "so do we have to do something?", add the sentence that answers it. If they would ask "does this affect us?", you skipped the context line.
Safeguard's reachability analysis helps with the context line by showing whether your code reaches the vulnerable function. A free scan is at gold.safeguard.sh/scan.
Quick check
Should I quote the CVSS score to a manager?
It helps to lead with the plain-language sentences. The score can follow, but arguments over a tenth of a point rarely help the decision.
Does the vector tell a manager whether we are affected?
No. It describes the flaw in general. You need to add whether you run the component and whether the vulnerable code is reachable.
Sources
Last reviewed: 19 October 2026.
