CVSS v4.0 By The Numbers

on YouTube ↗50m

" summary

Analysis of public CVSS v3.1 vs v4.0 vectors shows measurable re‑scoring, not just wording changes: a Cisco sample of 308 Cisco CVEs averages +0.36 points (max +2.6) with ~15% changing qualitative bin, the CVE program sample (~3,500 records) shows ~0.19 average change with ~33% bin shifts, GitHub reviewed data (2,720 records) averages +0.34 with ~23% bin shifts. A Python-based tool on GitHub performs the comparisons and plots histograms; several cases move from critical to medium, so per‑product reassessment and vector enrichment are necessary.

AI-written summary · about

" chapters (28)

1. 0:00CVSS v4.0 introduction
2. 1:28Why v4.0 is different
3. 3:13Why CVSS v4.0 numbers matter
4. 6:08Comparing CVSS scores statistically
5. 7:34Cisco’s v3.1 vs v4.0 data
6. 11:09CVE data on v3.1 vs v4.0 shifts
7. 14:01GitHub advisories under v4.0
8. 16:09GitHub unreviewed advisories v4.0
9. 17:15Trends in v3.1 vs v4.0 changes
10. 20:27Why v4.0 adoption is disruptive
11. 21:08Using CVSS v4.0 scores
12. 22:13Producers and CVSS v4.0
13. 24:22Resources for v4.0 adoption
14. 25:07CVSS does not equal risk
15. 26:11Scoring inflation in v4.0
16. 27:36Audience adoption of v4.0
17. 29:03CVSS SIG updates past year
18. 31:35v4.0 adoption and documentation
19. 33:21SIG examples and FAQ updates
20. 36:05Vendors reassessing scores
21. 38:56Challenges and survey results
22. 40:21Is v4.0 worth the effort?
23. 41:45Pain points blocking v4.0
24. 43:16Current CVSS version usage
25. 44:42Combining CVSS with others
26. 46:07Future of CVSS v4.0
27. 47:29How to join CVSS SIG
28. 48:58Closing remarks and Q&A

" related talks

• 01h 16mCVSS SIG Past, Present & Future + CVSS v4.0 Beyond the NumbersNick Leali · CVE/FIRST VulnCon 2024 & Annual CNA Summit
• 35mBlack and Blue, or White and Gold? Minimizing Vulnerability Scoring...Michael Schueler · CVE/FIRST VulnCon 2024 & Annual CNA Summit
• 40mCVSS Scores Are Dead. Let’s Explore 4 AlternativesAllan Liska · RSAC 2021
• 56mCVE Is The Worst Vulnerability Framework (Except For All The Others)Ben Edwards, Sander Vinberg · CVE/FIRST VulnCon 2024 & Annual CNA Summit
• 52mThe Evolution of CVEs, Vulnerability Management, and Hybrid ArchitecturesSander Vinberg, Dr. Benjamin Edwards · RSA Conference 2023
• 57mFIRST SIG UpdatesArt Manion, Aaron Kaplan, David Durvaux, Tom Millar, Dave Dugal, Rick Adrian, Nina Solha, Roderick Mooi, Mark Zajicek, Andreas Mühlemann, Olivier Caleff, Jeroen van der Hamm, Merike Kaeo · 34th Annual FIRST Conference 2022
• 58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization StandardsYotam Perkal · CVE/FIRST VulnCon 2024 & Annual CNA Summit
• 29mDiving into the CVSS Base Score Metrics - An Exploratory Analysis Bridging Product Security...Takayuki Uchiyama, Kohei Taguchi, Yuichi Kikuchi · CVE/FIRST VulnCon 2026 & Annual CNA Summit