These scores are helpful in telling organizations which vulnerabilities they should focus on

first, but the true risk posed by any given vulnerability depends on some other factors
beyond these out-of-the-box risk ratings and scores