An organization wants to implement a vulnerability management program with risk-based prioritization. Beyond the CVSS base score, which additional factor most significantly changes the effective risk of a vulnerability?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because active exploitation confirmed by threat intelligence dramatically increases the probability of exploitation, turning a theoretical risk into an active threat; a vulnerability actively exploited by threat actors against the same industry sector is immediately actionable regardless of its CVSS score. A is wrong because code complexity affects how difficult the vulnerability is to analyze but does not directly indicate exploitation likelihood.
Full explanation below image
Full Explanation
B is correct because active exploitation confirmed by threat intelligence dramatically increases the probability of exploitation, turning a theoretical risk into an active threat; a vulnerability actively exploited by threat actors against the same industry sector is immediately actionable regardless of its CVSS score. A is wrong because code complexity affects how difficult the vulnerability is to analyze but does not directly indicate exploitation likelihood. C is wrong because vendor communication style has no bearing on the technical risk of the vulnerability. D is wrong because whether a CVE was assigned by MITRE directly or a CNA does not affect the technical severity or exploitation likelihood.