Scoring
A CVSS 9.8 on a brochure page is not an emergency
Severity scores describe a vulnerability. They do not describe what it would cost you. Every finding here carries an Exception Impact Score as well as its CVSS, and the EIS is the number the work is organised around — including what the finding is worth to the researcher who found it.
The same flaw, twice
Both rows below are the same class of issue: reachable over the network, low complexity, exposing data it should not. The technical severity is almost identical. The answer is not.
| Where it is | Technical base | Business multiplier | EIS | Severity |
|---|---|---|---|---|
| Static marketing page, public data, unregulated | 6.67 | 0.48× | 0.3 | Informational |
| Payment processing, confidential data, bank regulation | 6.94 | 13.05× | 9.7 | Critical |
Those are the real outputs of the scorer, not illustrations. The second case is harder to exploit than the first — it needs an authenticated session, so its exploitability component is lower — and it still scores thirty times higher, because of what sits behind it.
What goes into it
EIS starts from the technical picture, then weights it by the three things that decide what an incident actually costs.
- The asset it touches. Payment processing carries the heaviest weight, then authentication, then customer records and financial reporting, down to internal tooling and static marketing pages. This is set by an analyst here, against a scope you named — not by the person who submitted the finding.
- The data it reaches. Confidential and restricted data raise the score; public data does not.
- The regime you operate under. Banking and card rules weigh heaviest, then healthcare, insurance and the GDPR perimeter. An unregulated surface is weighted down rather than up.
- The quality of the report. A working proof, exploit code, a remediation guide, an analysis of how the steps chain together — each adds a bounded amount. This exists so that a report your engineers can act on immediately is worth more than one they have to reconstruct.
Every finding carries its full breakdown and a vector string, so the number can be argued with rather than taken on trust:
EIS:1.0/AV:N/AC:L/AU:S/C:H/I:H/A:N/AT:PP/DC:C/IR:B → 9.7 CRITICAL
Why it is not just a label
The score sets the recommended reward band for the finding. That is the part that matters commercially, and it cuts both ways deliberately.
A researcher who finds something reachable on a payment path is paid as though it mattered, because it did. A researcher who reports a textbook issue on a page carrying nothing is not, however alarming its CVSS looks. The incentive points at the systems you actually care about, without anyone having to police it in a conversation afterwards.
You still set the rewards for your own programme, and you still pay only for findings you accept. EIS decides what a finding is ranked and recommended at; it does not decide what you agree to.
What this does not do
It does not replace CVSS, and CVSS is recorded alongside it on every finding — your own reporting, insurers and auditors expect it, and it stays there unmodified. It is not a compliance score, and it is not a substitute for a scheduled assessment against a control framework.
It also cannot be right about your business without being told about your business. The asset and data classifications are set per engagement, from the scope you define. A programme that never has that conversation gets generic weighting and deserves to be trusted less.
The method is here rather than in a sales deck because it is the sort of thing a security team should be able to disagree with before signing anything. If you think the weighting is wrong for your estate, that is a conversation worth having before an engagement rather than after the first finding lands. The architecture sets out the rest of the mechanism, and the free posture check needs no conversation at all.