Different cyber vulnerability scores produced different priority rankings in a preprint analysis. The comparison applied CVSS, EPSS, SSVC and IronMiner to a reconstruction of the 2015 Ukraine Power Grid network and found that the systems overlapped in some measures but were not interchangeable.
The work was a modeling comparison, not a randomized intervention. It applied multiple scoring systems to a reconstructed OT incident topology and compared their outputs. The document does not report randomization, a conventional control group, preregistration or a power or sample-size rationale.
The CVSS version mattered
The dataset contained 659 vulnerability records from 12 information systems and 27 software products, representing 592 unique CVEs. A direct version comparison was available for 113 records with complete CVSSv2 and CVSSv3 scores.
Among those 113 vulnerabilities, the mean CVSSv2 base score was 6.37, compared with 7.55 for CVSSv3. The exploitability measure moved in the opposite direction: its mean was 8.26 for CVSSv2 and 2.89 for CVSSv3.
The average size of the gap, without regard to which version was higher, was 5.37 points for exploitability, compared with 1.92 points for impact and 1.52 points for the base score. The largest observed base-score difference was 5.70 points.
Other measures changed the picture
EPSS also shifted when the analysis extended its time horizon to 365 days. The original measure had a median of 0.03 and a mean of 0.17. EPSS365 had a median of 0.35 and a mean of 0.47, while its 75th percentile was 0.90. The analysis treated the extended measure as an estimate of exploitation likelihood over a longer period, rather than a direct severity score.
IronMiner had a mean of 7.55, matching the reported CVSSv3 mean, but its median was 7.90 and its standard deviation, a measure of spread, was 2.11. The matching averages therefore did not mean the two systems produced the same distribution.
For SSVC, the study used a custom mapping to turn categorical decisions into numerical values and described that mapping as heuristic. The estimates used the Coordinator decision tree, with exploitation status derived from the VulnCheck KEV catalog, some decision points derived from CVSS metrics, and mission prevalence based on attack-graph node placement. The resulting proxy values were tightly concentrated: the median, first quartile and third quartile were all 2.00, the mean was 2.82 and the maximum was 8.00. At least 75% of observations had a value of 2.
Agreement was partial
To compare ordering, the analysis used Spearman rank correlations, a statistic that shows whether two lists tend to rise and fall together. Corresponding CVSS impact scores had a correlation of 0.82, and corresponding exploitability scores had a correlation of 0.86. EPSS365 and IronMiner correlated at 0.77. SSVC generally had weak correlations with the other measures.
The pattern points to partial agreement, not a single master ranking. The authors concluded that the scoring systems capture overlapping but non-equivalent dimensions of vulnerability risk and should not be treated as interchangeable.
A proposal still awaiting validation
The paper proposed a weighted composite score and a CVSS-anchored priority score. But it described the weighting, mapping and interaction assumptions behind them as heuristic rather than formally validated risk measures.
That caution matters because the analysis was built around a reconstructed incident topology and a reported vulnerability dataset. The document is an arXiv version 1 preprint dated 29 September 2026. It does not report a funding source, and its front matter lists a Lockheed Martin affiliation.
For vulnerability prioritization, the practical message is that changing the scoring lens can change which risks stand out. In the reconstructed network, the authors concluded that the measures captured overlapping but non-equivalent dimensions of vulnerability risk, so one should not be treated as a substitute for the others.
Paper data and sources
Original title: When Cyber Scoring Systems Diverge: An Empirical Comparison
Authors: Kirsi Hellsten, Joni Herttuainen, Ambrose Kam et al.
Journal/Repository: arXiv
Status: Preprint, not yet peer-reviewed
First online: 2026-09-29
DOI: Not available
Original paper · Full text