I've pondered for a while on how to score tactics/kill chain steps using CVSS, but this morning it occurred to me that you could take that further and score:
a) average CVSS exposures by product
b) (and describe) a threat model scenario in CVSS
I don't have the time for the maths forf a right now, but consider this:
* Internet facing web server running a PHP app: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L: 7.3
* Internet facing mail server: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L: 7.1
* Active Directory: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H: 9.0
* Database server: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: 8.0
Not sure the numbers come out quite right, but just as with tactics, a lot of the properties are there to capture the properties of likely types of attack and their relative severity based on system type more generically...
#threatmodelling
Tim (Wadhwa-)Brown :donor:
npub1fe…a8w07
2026-10-25 08:15:14 UTC
Author Public Key
npub1feda6kwfz0r3vxaferk7alqjpe00gce0gz8n9dfk2zd4kf8q2ngs6a8w07Seen on
wss://relay.momostr.pinkPublished at
2026-10-25 08:15:14 UTCEvent JSON
{
"id": "cd6f583938a86aee89db2ab5a60796ac47f8a67b4479b837de00b4c772b9fc4a",
"pubkey": "4e5bdd59c913c7161ba9c8edeefc120e5ef4632f408f32b536509b5b24e054d1",
"created_at": 1792916114,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/@timb_machine/117500550465786470",
"web"
],
[
"t",
"threatmodelling"
],
[
"proxy",
"https://infosec.exchange/users/timb_machine/statuses/117500550465786470",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/timb_machine/statuses/117500550465786470",
"pink.momostr"
],
[
"-"
]
],
"content": "I've pondered for a while on how to score tactics/kill chain steps using CVSS, but this morning it occurred to me that you could take that further and score:\n\na) average CVSS exposures by product\nb) (and describe) a threat model scenario in CVSS\n\nI don't have the time for the maths forf a right now, but consider this:\n\n* Internet facing web server running a PHP app: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L: 7.3\n* Internet facing mail server: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L: 7.1\n* Active Directory: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H: 9.0\n* Database server: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: 8.0\n\nNot sure the numbers come out quite right, but just as with tactics, a lot of the properties are there to capture the properties of likely types of attack and their relative severity based on system type more generically...\n\n#threatmodelling",
"sig": "91cd316e2d7d3e6bb75ead328ab87e93a5d2be4b0bdaf98663ad11b4ce9beb8cb8545db8e2373c97bcc7b2f94e12c2411bc22871973a9088d6962d0c74557d14"
}