Why using CVSS for vulnerability management is nuts. How to fix the vulnerabilities that truly matter, and how to create and measure an effective security practice.
Why CVSS Sucks and How To Do It Better
slideshare.net