01
CVSS answers the wrong question
The base score tells you how bad a flaw could be in the abstract. It says nothing about whether this asset matters to your institution, whether it is reachable from outside, or whether anyone is exploiting it today.
-
a
It measures severity, not risk.
A 9.8 base score describes worst-case technical impact under hypothetical conditions. It is one ingredient of risk, not risk itself — and treating it as a decision is what fills triage queues with theoretical danger.
-
b
It is blind to asset criticality and exposure.
The same CVE on a public-facing student records system and on an isolated lab workstation scores identically. Institutional value and network reachability never enter the equation — yet they are the variables that decide whether harm actually occurs.
-
c
It ignores real exploitation likelihood.
Most high-severity CVEs are never weaponised. Without an EPSS-style probability, teams chase abstract worst cases while genuinely active threats wait their turn behind louder ones.
02
Try it — and see exactly how the score is built
Pick a scenario or move any slider. Every part of the score updates live, the math is exposed line-by-line, and a stacked bar shows which input is driving the result — so the score is never a black box.
Load a scenario
Inputs
AHP weights
Sliders auto-normalise so w1+w2+w3+w4 = 1.000.
Verdict
MEDIUM
Moderate priority — fix during normal patch cycle, monitor for change.
Delta vs CVSS
−5.76
Context-aware risk is lower than CVSS suggests.
CVSS-only
9.8
severity in isolation
Context-aware risk
4.04
severity × context × likelihood
What's driving the score
out of 10
Each block is one input × its weight × 10. The longest block is the dominant driver.
How the score breaks down
The same calculation, written out.
In plain English
—
03
Prioritisation changes everything
Six real-world higher-education vulnerabilities, scored with the default AHP weights. Sorting by context-aware risk reshuffles the queue — the headline OpenSSL flaw sinks; the quiet SQL injection rises to the top.
| Vulnerability | CVSS | EPSS | Crit | Exp | Context risk |
|---|
Rank movement
CVSS rank → Context rank
Each line is one vulnerability moving from its CVSS rank (left) to its context-aware rank (right).
▲ moves up vs CVSS ▼ moves down vs CVSS — unchanged
04
What each existing system captures
Existing frameworks each address part of the picture. Only the proposed model spans severity, likelihood, institutional context, decision support, and maturity integration.
| System | Severity | Exploit likelihood | Asset / context | Decision support | Maturity integration |
|---|
✓ full · ◐ partial · — absent
05 · The contribution
One risk-weighted score that feeds a maturity assessment.
This model integrates technical severity, real-world exploitation likelihood, and institutional context — asset criticality and exposure — into a single, AHP-weighted risk score on a 0–10 scale. Unlike severity-only systems such as CVSS, that score is not an endpoint: it feeds directly into a higher- education cybersecurity maturity assessment, linking individual vulnerability triage to institutional capability. The result is prioritisation that reflects what is actually at risk, and a measurable bridge from day-to-day remediation to long-term security maturity.