When Cyber Scoring Systems Diverge: An Empirical Comparison
CVSS, EPSS, SSVC, and IronMiner disagree sharply on a reconstructed 2015 Ukraine grid OT network.
The paper compares CVSS, EPSS, SSVC, and the proprietary IronMiner scorer inside a system-level risk model rather than through vulnerability-database correlations alone. The substrate is a reconstruction of the 2015 Ukraine power-grid operational-technology network with a documented incident topology. The four systems disagree substantially, so the chosen scorer can change which vulnerabilities are prioritized and how mitigations are sequenced. The authors suggest a composite or hybrid score may be more suitable for operational decisions.
- Compares CVSS, EPSS, SSVC, and IronMiner on one OT topology
- Uses a reconstruction of the 2015 Ukraine power-grid network
- Large disagreement implies different vulnerability priorities
- Authors argue a hybrid score may fit operations better
From the original article
1 min read at arxiv.orgVulnerability scoring systems underpin cyber patch prioritization and risk management, but their comparative behavior is almost always assessed in the abstract, through correlation studies in IT vulnerability databases, rather than by the operational consequences they produce when embedded in a system-level risk model.
By Kirsi Hellsten · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.