> the ratings themselves are total horseshit and are running industry joke
Any further references to this? I’d love to have something I can send around internally. The people running Tenable tend to treat these numbers as gospel.
Any further references to this? I’d love to have something I can send around internally. The people running Tenable tend to treat these numbers as gospel.
We also do this with pen test reports which suffer the same kinds of issues.
Usually find that sometimes a medium is a critical for us and some times a high is a low for us - based on performing this kind of assessment.
Totally agree, and I do that - check the vulnerability description, see if we’re using that part of the library, etc… it usually works out that we’re not actually affected by whatever the alert is.