Tell executives that a CVSS score rates how bad a flaw could be in general, not how likely it is to hurt your business. Then add three facts: whether it is being exploited, whether your code can reach it, and what the affected system does for the company.
What the score actually is
FIRST, the body that maintains CVSS, says the Base score is designed to measure severity and should not be used alone to assess risk. It recommends supplementing it with environmental and threat analysis. It also asks that scores be labelled with the metric groups used: CVSS-B for base only, CVSS-BT with threat metrics, CVSS-BE with environmental, and CVSS-BTE with both.
That naming matters in a report. A bare "9.8" could be a base score from an advisory or a score adjusted for your environment. Say which.
The translation in three questions
| Question | Where the answer comes from | Executive phrasing |
|---|---|---|
| Is it being exploited? | The CISA KEV catalog, exploit evidence, a probability signal such as EPSS | "Attackers are using this" or "no evidence of use yet" |
| Can our code reach it? | Reachability analysis, architecture review | "The vulnerable function is called in our product" or "present but not called" |
| What does the system do? | Asset inventory, data classification | "It handles customer payments" or "an internal test tool" |
EPSS, from FIRST, estimates the probability that a published CVE will be exploited in the wild in the next 30 days, published daily for every CVE. It is a likelihood estimate, not a severity rating, so it complements CVSS instead of replacing it.
A plain language template
"This flaw is rated [severity] in general. For us it matters because [exploited or not], [reachable or not], and it sits in [system and what it does]. We will fix it by [date]." Fill the brackets from your own findings.
Avoid these phrasings
- "It is a 9.8, so it is the worst." A high base score without context can describe a flaw you cannot reach
- "It is only a 5, so ignore it." A medium base score can matter if it is actively exploited and sits on an exposed system
- Giving a score with no scale. Say that CVSS runs from zero to ten
Steps for a briefing
- Choose the top few items by exploitation evidence first, then reachability, then system criticality.
- Write one sentence for each in the template above.
- State the fix date and owner.
- Offer the full list separately.
For using EPSS in a leadership report, see how to use EPSS in a leadership report.
Safeguard's reachability analysis can show whether a vulnerable function is called, which supplies the second answer above. Try the free scan on a repository.
Try it yourself
Click through it at your own pace, or open it full screen.
Compare the score with the exploitability evidence and decide how you would word each for an executive.
Quick check
Is a higher CVSS score always more urgent?
No. It signals potential severity. Urgency depends on exploitation evidence, reachability and the importance of the affected system.
Do I have to use CVSS at all?
It remains a common shared language and many advisories carry it. Use it as one input, labelled clearly.
Sources
- FIRST, CVSS v4.0 user guide: https://www.first.org/cvss/v4-0/user-guide
- FIRST, EPSS: https://www.first.org/epss/
Last reviewed: 19 October 2026.
