{"id":"https://openalex.org/W4416549283","doi":"https://doi.org/10.1145/3719027.3765210","title":"Conflicting Scores, Confusing Signals: An Empirical Study of Vulnerability Scoring Systems","display_name":"Conflicting Scores, Confusing Signals: An Empirical Study of Vulnerability Scoring Systems","publication_year":2025,"publication_date":"2025-11-19","ids":{"openalex":"https://openalex.org/W4416549283","doi":"https://doi.org/10.1145/3719027.3765210"},"language":null,"primary_location":{"id":"doi:10.1145/3719027.3765210","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3719027.3765210","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3719027.3765210","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3719027.3765210","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5042352400","display_name":"Viktoria Koscinski","orcid":"https://orcid.org/0000-0003-1616-0167"},"institutions":[{"id":"https://openalex.org/I155173764","display_name":"Rochester Institute of Technology","ror":"https://ror.org/00v4yb702","country_code":"US","type":"education","lineage":["https://openalex.org/I155173764"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Viktoria Koscinski","raw_affiliation_strings":["Rochester Institute of Technology, Rochester, NY, USA"],"raw_orcid":"https://orcid.org/0000-0003-1616-0167","affiliations":[{"raw_affiliation_string":"Rochester Institute of Technology, Rochester, NY, USA","institution_ids":["https://openalex.org/I155173764"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5069230304","display_name":"Marita L. Nelson","orcid":"https://orcid.org/0000-0002-0775-0627"},"institutions":[{"id":"https://openalex.org/I117965899","display_name":"University of Hawai\u02bbi at M\u0101noa","ror":"https://ror.org/01wspgy28","country_code":"US","type":"education","lineage":["https://openalex.org/I117965899"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Mark Nelson","raw_affiliation_strings":["University of Hawai'i at M\u0101noa, Honolulu, HI, USA"],"raw_orcid":"https://orcid.org/0000-0002-0775-0627","affiliations":[{"raw_affiliation_string":"University of Hawai'i at M\u0101noa, Honolulu, HI, USA","institution_ids":["https://openalex.org/I117965899"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5040805050","display_name":"Ahmet Okutan","orcid":"https://orcid.org/0000-0001-6664-515X"},"institutions":[{"id":"https://openalex.org/I114662689","display_name":"Leidos (United States)","ror":"https://ror.org/012cvds63","country_code":"US","type":"company","lineage":["https://openalex.org/I114662689"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ahmet Okutan","raw_affiliation_strings":["Leidos, Reston, VA, USA"],"raw_orcid":"https://orcid.org/0000-0001-6664-515X","affiliations":[{"raw_affiliation_string":"Leidos, Reston, VA, USA","institution_ids":["https://openalex.org/I114662689"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5119919542","display_name":"Robert Falso","orcid":"https://orcid.org/0009-0009-8354-0830"},"institutions":[{"id":"https://openalex.org/I155173764","display_name":"Rochester Institute of Technology","ror":"https://ror.org/00v4yb702","country_code":"US","type":"education","lineage":["https://openalex.org/I155173764"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Robert Falso","raw_affiliation_strings":["Rochester Institute of Technology, Rochester, NY, USA"],"raw_orcid":"https://orcid.org/0009-0009-8354-0830","affiliations":[{"raw_affiliation_string":"Rochester Institute of Technology, Rochester, NY, USA","institution_ids":["https://openalex.org/I155173764"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5088410123","display_name":"Mehdi Mirakhorli","orcid":"https://orcid.org/0000-0003-3470-6856"},"institutions":[{"id":"https://openalex.org/I117965899","display_name":"University of Hawai\u02bbi at M\u0101noa","ror":"https://ror.org/01wspgy28","country_code":"US","type":"education","lineage":["https://openalex.org/I117965899"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Mehdi Mirakhorli","raw_affiliation_strings":["University of Hawai'i at M\u0101noa, Honolulu, HI, USA"],"raw_orcid":"https://orcid.org/0009-0000-7963-3756","affiliations":[{"raw_affiliation_string":"University of Hawai'i at M\u0101noa, Honolulu, HI, USA","institution_ids":["https://openalex.org/I117965899"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":7.6984,"has_fulltext":true,"cited_by_count":4,"citation_normalized_percentile":{"value":0.97635284,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":98,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"1904","last_page":"1918"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.8661999702453613,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.8661999702453613,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.04830000177025795,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.029899999499320984,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/categorization","display_name":"Categorization","score":0.8052999973297119},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.784600019454956},{"id":"https://openalex.org/keywords/prioritization","display_name":"Prioritization","score":0.6897000074386597},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.675599992275238},{"id":"https://openalex.org/keywords/empirical-research","display_name":"Empirical research","score":0.5397999882698059},{"id":"https://openalex.org/keywords/rank","display_name":"Rank (graph theory)","score":0.5044000148773193},{"id":"https://openalex.org/keywords/vulnerability-assessment","display_name":"Vulnerability assessment","score":0.4853000044822693},{"id":"https://openalex.org/keywords/triage","display_name":"Triage","score":0.47110000252723694}],"concepts":[{"id":"https://openalex.org/C94124525","wikidata":"https://www.wikidata.org/wiki/Q912550","display_name":"Categorization","level":2,"score":0.8052999973297119},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.784600019454956},{"id":"https://openalex.org/C2777615720","wikidata":"https://www.wikidata.org/wiki/Q11888847","display_name":"Prioritization","level":2,"score":0.6897000074386597},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6780999898910522},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.675599992275238},{"id":"https://openalex.org/C120936955","wikidata":"https://www.wikidata.org/wiki/Q2155640","display_name":"Empirical research","level":2,"score":0.5397999882698059},{"id":"https://openalex.org/C164226766","wikidata":"https://www.wikidata.org/wiki/Q7293202","display_name":"Rank (graph theory)","level":2,"score":0.5044000148773193},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.4853000044822693},{"id":"https://openalex.org/C2777120189","wikidata":"https://www.wikidata.org/wiki/Q780067","display_name":"Triage","level":2,"score":0.47110000252723694},{"id":"https://openalex.org/C2984538763","wikidata":"https://www.wikidata.org/wiki/Q2260590","display_name":"Scoring system","level":2,"score":0.44179999828338623},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.41780000925064087},{"id":"https://openalex.org/C176217482","wikidata":"https://www.wikidata.org/wiki/Q860554","display_name":"Metric (unit)","level":2,"score":0.4146000146865845},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.38929998874664307},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.3783000111579895},{"id":"https://openalex.org/C207390915","wikidata":"https://www.wikidata.org/wiki/Q1230525","display_name":"Divergence (linguistics)","level":2,"score":0.3709000051021576},{"id":"https://openalex.org/C12174686","wikidata":"https://www.wikidata.org/wiki/Q1058438","display_name":"Risk assessment","level":2,"score":0.33000001311302185},{"id":"https://openalex.org/C172776598","wikidata":"https://www.wikidata.org/wiki/Q7943570","display_name":"Vulnerability management","level":4,"score":0.32820001244544983},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3133000135421753},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.29750001430511475},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.2948000133037567},{"id":"https://openalex.org/C32896092","wikidata":"https://www.wikidata.org/wiki/Q189447","display_name":"Risk management","level":2,"score":0.27950000762939453},{"id":"https://openalex.org/C166052673","wikidata":"https://www.wikidata.org/wiki/Q83021","display_name":"Empirical evidence","level":2,"score":0.27639999985694885},{"id":"https://openalex.org/C189430467","wikidata":"https://www.wikidata.org/wiki/Q7293293","display_name":"Ranking (information retrieval)","level":2,"score":0.2702000141143799},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.26170000433921814},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2549999952316284}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3719027.3765210","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3719027.3765210","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3719027.3765210","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3719027.3765210","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3719027.3765210","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3719027.3765210","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320306110","display_name":"U.S. Department of Homeland Security","ror":"https://ror.org/00jyr0d86"},{"id":"https://openalex.org/F4320306487","display_name":"Research Corporation for Science Advancement","ror":"https://ror.org/00jp8d455"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4416549283.pdf","grobid_xml":"https://content.openalex.org/works/W4416549283.grobid-xml"},"referenced_works_count":31,"referenced_works":["https://openalex.org/W150078352","https://openalex.org/W384698140","https://openalex.org/W1981796233","https://openalex.org/W1990091526","https://openalex.org/W2044625105","https://openalex.org/W2108629901","https://openalex.org/W2131353092","https://openalex.org/W2135198734","https://openalex.org/W2162142914","https://openalex.org/W2162739315","https://openalex.org/W2565077509","https://openalex.org/W2771090858","https://openalex.org/W2808052182","https://openalex.org/W2974695716","https://openalex.org/W3023951208","https://openalex.org/W3084558590","https://openalex.org/W3136969503","https://openalex.org/W3175201754","https://openalex.org/W3184339106","https://openalex.org/W3194789266","https://openalex.org/W3199469813","https://openalex.org/W3210360585","https://openalex.org/W4210262502","https://openalex.org/W4210318281","https://openalex.org/W4293193423","https://openalex.org/W4293235203","https://openalex.org/W4309089965","https://openalex.org/W4312798241","https://openalex.org/W4322627146","https://openalex.org/W4400976724","https://openalex.org/W4408343551"],"related_works":[],"abstract_inverted_index":{"Accurately":[0],"assessing":[1],"software":[2],"vulnerabilities":[3,76,104],"is":[4],"essential":[5],"for":[6,133,158],"effective":[7],"prioritization":[8,30],"and":[9,24,65,108,150,161,165],"remediation.":[10],"While":[11],"various":[12],"scoring":[13,46,125],"systems":[14,126],"exist":[15],"to":[16,28,86,112,139],"support":[17,96],"this":[18],"task,":[19,99],"their":[20,110],"differing":[21],"goals,":[22],"methodologies":[23],"outputs":[25],"often":[26],"lead":[27],"inconsistent":[29],"decisions.":[31,143],"This":[32],"work":[33],"provides":[34],"the":[35,48,54,59,66,88,114,128,148,156],"first":[36],"large-scale,":[37],"outcome-linked":[38],"empirical":[39],"comparison":[40],"of":[41,73,81,152],"four":[42,79],"publicly":[43],"available":[44],"vulnerability":[45,97],"systems:":[47],"Common":[49],"Vulnerability":[50,56],"Scoring":[51,62],"System":[52,63],"(CVSS),":[53],"Stakeholder-Specific":[55],"Categorization":[57],"(SSVC),":[58],"Exploit":[60],"Prediction":[61],"(EPSS),":[64],"Exploitability":[67],"Index.":[68],"We":[69,144],"use":[70],"a":[71],"dataset":[72],"600":[74],"real-world":[75,115],"derived":[77],"from":[78],"months":[80],"Microsoft's":[82],"Patch":[83],"Tuesday":[84],"disclosures":[85],"investigate":[87],"relationships":[89],"between":[90],"these":[91,101,137,153],"scores,":[92],"evaluate":[93],"how":[94,100,124],"they":[95],"management":[98],"scores":[102],"categorize":[103],"across":[105],"triage":[106],"tiers,":[107],"assess":[109],"ability":[111],"capture":[113],"exploitation":[116],"risk.":[117],"Our":[118],"findings":[119],"reveal":[120],"significant":[121],"disparities":[122],"in":[123],"rank":[127],"same":[129],"vulnerabilities,":[130],"with":[131],"implications":[132],"organizations":[134],"relying":[135],"on":[136],"metrics":[138],"make":[140],"data-driven,":[141],"risk-based":[142],"provide":[145],"insights":[146],"into":[147],"alignment":[149],"divergence":[151],"systems,":[154],"highlighting":[155],"need":[157],"more":[159],"transparent":[160],"consistent":[162],"exploitability,":[163],"risk,":[164],"severity":[166],"assessments.":[167]},"counts_by_year":[{"year":2026,"cited_by_count":4}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-11-23T00:00:00"}