A scanner usually reports a generic severity score for a known flaw. A pen tester rates what the flaw means in your system after trying it: who can reach it, what it exposes and what it chains to. The same weakness can be high on paper and low in practice, or the reverse.
What a scanner score measures
Most scanners show a CVSS base score. FIRST's CVSS user guide states that base scores measure severity, not risk, and that they should not be used alone to assess risk. It recommends supplementing them with environmental metrics, which reflect your own context, and threat metrics, which capture factors that change over time.
So a scanner's number is a starting point. It says how bad the flaw can be in general, not how bad it is for you.
What a pen tester adds
- Exposure. Can an anonymous user reach it or only an admin on a private network?
- Impact in context. What data or function sits behind it?
- Chaining. A medium issue plus another medium issue can lead to a critical outcome. NIST describes penetration testing as looking for combinations of vulnerabilities.
- Proof. NIST notes the attack phase exploits the vulnerability to confirm it.
Why ratings diverge
| Situation | Scanner says | Tester says | Reason |
|---|---|---|---|
| Vulnerable library, code never called | High | Low or not exploitable | No path to the flaw |
| Info disclosure on an internal page | Low | High | Page leaks a key used elsewhere |
| Missing header | Medium | Low | Little real impact here |
| Two medium flaws combined | Medium, Medium | Critical | Chain gives account takeover |
How to reconcile the two
- Record both ratings in your tracker with their source.
- Use the tester's rating for items they exploited, since it is based on evidence.
- Use your own context for scanner only items: exposure, data sensitivity, whether it is reachable.
- Add exploit signals. CISA's Known Exploited Vulnerabilities catalog lists flaws known to be exploited in the wild, and EPSS estimates the probability a CVE will be exploited in the next 30 days.
- Set your SLA by the final rating, and write down why it differs from the scanner.
- Tell the auditor or customer which rating drives your deadlines, in your policy.
Try it yourself
Open the demo and look at how a finding is checked for exploitability, then ask how that changes the priority compared with the raw score.
Click through it at your own pace, or open it full screen.
Quick check
Which rating should I trust?
For findings the tester exploited, trust the tester's rating because it rests on evidence. For the rest, adjust the scanner score using your own context.
Is CVSS wrong?
No. The base score measures severity in general. The CVSS guide itself says to add environment and threat context to approach risk.
Safeguard adds context to dependency findings with reachability analysis, so priorities reflect what your code can reach. Try the free scan.
Sources
- FIRST CVSS v4.0 user guide
- FIRST EPSS
- CISA Known Exploited Vulnerabilities catalog
- NIST glossary: penetration testing
Last reviewed: 19 October 2026.
