{"id":"https://openalex.org/W7153987910","doi":"https://doi.org/10.1145/3772318.3790409","title":"Tool-Assisted CVSS Vulnerability Scoring: A Controlled Quantitative Study of Human Assessment","display_name":"Tool-Assisted CVSS Vulnerability Scoring: A Controlled Quantitative Study of Human Assessment","publication_year":2026,"publication_date":"2026-04-13","ids":{"openalex":"https://openalex.org/W7153987910","doi":"https://doi.org/10.1145/3772318.3790409"},"language":"en","primary_location":{"id":"doi:10.1145/3772318.3790409","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3772318.3790409","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2026 CHI Conference on Human Factors in Computing Systems","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3772318.3790409","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5133517596","display_name":"Siqi Zhang","orcid":"https://orcid.org/0009-0009-4490-8671"},"institutions":[{"id":"https://openalex.org/I865915315","display_name":"Vrije Universiteit Amsterdam","ror":"https://ror.org/008xxew50","country_code":"NL","type":"education","lineage":["https://openalex.org/I865915315"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Siqi Zhang","raw_affiliation_strings":["Department of Computer Science, Vrije Universiteit Amsterdam, Amsterdam, NH, Netherlands"],"raw_orcid":"https://orcid.org/0009-0009-4490-8671","affiliations":[{"raw_affiliation_string":"Department of Computer Science, Vrije Universiteit Amsterdam, Amsterdam, NH, Netherlands","institution_ids":["https://openalex.org/I865915315"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5033974525","display_name":"Minjie Cai","orcid":null},"institutions":[{"id":"https://openalex.org/I67031392","display_name":"Carleton University","ror":"https://ror.org/02qtvee93","country_code":"CA","type":"education","lineage":["https://openalex.org/I67031392"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Minjie Cai","raw_affiliation_strings":["School of Computer Science, Carleton University, Ottawa, Ontario, Canada"],"raw_orcid":"https://orcid.org/0009-0002-3452-7292","affiliations":[{"raw_affiliation_string":"School of Computer Science, Carleton University, Ottawa, Ontario, Canada","institution_ids":["https://openalex.org/I67031392"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5075517496","display_name":"Lianying Zhao","orcid":"https://orcid.org/0000-0002-6376-4062"},"institutions":[{"id":"https://openalex.org/I67031392","display_name":"Carleton University","ror":"https://ror.org/02qtvee93","country_code":"CA","type":"education","lineage":["https://openalex.org/I67031392"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Lianying Zhao","raw_affiliation_strings":["Carleton University, Ottawa, Ontario, Canada"],"raw_orcid":"https://orcid.org/0000-0002-6376-4062","affiliations":[{"raw_affiliation_string":"Carleton University, Ottawa, Ontario, Canada","institution_ids":["https://openalex.org/I67031392"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5025487194","display_name":"Xavier de Carn\u00e9 de Carnavalet","orcid":"https://orcid.org/0000-0003-2664-3963"},"institutions":[{"id":"https://openalex.org/I145872427","display_name":"Radboud University Nijmegen","ror":"https://ror.org/016xsfp80","country_code":"NL","type":"education","lineage":["https://openalex.org/I145872427"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Xavier de Carn\u00e9 de Carnavalet","raw_affiliation_strings":["Digital Security group, Radboud University, Nijmegen, Netherlands"],"raw_orcid":"https://orcid.org/0000-0003-2664-3963","affiliations":[{"raw_affiliation_string":"Digital Security group, Radboud University, Nijmegen, Netherlands","institution_ids":["https://openalex.org/I145872427"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133513968","display_name":"Fabio Massacci","orcid":"https://orcid.org/0000-0002-1091-8486"},"institutions":[{"id":"https://openalex.org/I193223587","display_name":"University of Trento","ror":"https://ror.org/05trd4x28","country_code":"IT","type":"education","lineage":["https://openalex.org/I193223587"]},{"id":"https://openalex.org/I865915315","display_name":"Vrije Universiteit Amsterdam","ror":"https://ror.org/008xxew50","country_code":"NL","type":"education","lineage":["https://openalex.org/I865915315"]}],"countries":["IT","NL"],"is_corresponding":false,"raw_author_name":"Fabio Massacci","raw_affiliation_strings":["Department of Computer Science, Vrije Universiteit Amsterdam, Amsterdam, NH, Netherlands and DISI, University of Trento, Trento, TN, Italy"],"raw_orcid":"https://orcid.org/0000-0002-1091-8486","affiliations":[{"raw_affiliation_string":"Department of Computer Science, Vrije Universiteit Amsterdam, Amsterdam, NH, Netherlands and DISI, University of Trento, Trento, TN, Italy","institution_ids":["https://openalex.org/I193223587","https://openalex.org/I865915315"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5023224430","display_name":"Mengyuan Zhang","orcid":"https://orcid.org/0000-0001-7457-5198"},"institutions":[{"id":"https://openalex.org/I865915315","display_name":"Vrije Universiteit Amsterdam","ror":"https://ror.org/008xxew50","country_code":"NL","type":"education","lineage":["https://openalex.org/I865915315"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Mengyuan Zhang","raw_affiliation_strings":["Department of Computer Science, Vrije Universiteit Amsterdam, Amsterdam, Netherlands"],"raw_orcid":"https://orcid.org/0000-0001-7457-5198","affiliations":[{"raw_affiliation_string":"Department of Computer Science, Vrije Universiteit Amsterdam, Amsterdam, Netherlands","institution_ids":["https://openalex.org/I865915315"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":1,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"24"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.6560999751091003,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.6560999751091003,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11800","display_name":"User Authentication and Security Systems","score":0.0430000014603138,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12607","display_name":"Personal Information Management and User Behavior","score":0.016899999231100082,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.7603999972343445},{"id":"https://openalex.org/keywords/vulnerability-assessment","display_name":"Vulnerability assessment","score":0.5569999814033508},{"id":"https://openalex.org/keywords/affect","display_name":"Affect (linguistics)","score":0.5167999863624573},{"id":"https://openalex.org/keywords/work","display_name":"Work (physics)","score":0.45739999413490295},{"id":"https://openalex.org/keywords/risk-assessment","display_name":"Risk assessment","score":0.4471000134944916},{"id":"https://openalex.org/keywords/quantitative-assessment","display_name":"Quantitative assessment","score":0.3919000029563904}],"concepts":[{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.7603999972343445},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.61080002784729},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.5569999814033508},{"id":"https://openalex.org/C2776035688","wikidata":"https://www.wikidata.org/wiki/Q1606558","display_name":"Affect (linguistics)","level":2,"score":0.5167999863624573},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.45739999413490295},{"id":"https://openalex.org/C12174686","wikidata":"https://www.wikidata.org/wiki/Q1058438","display_name":"Risk assessment","level":2,"score":0.4471000134944916},{"id":"https://openalex.org/C2984588014","wikidata":"https://www.wikidata.org/wiki/Q730675","display_name":"Quantitative assessment","level":2,"score":0.3919000029563904},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3637999892234802},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.3287000060081482},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.3269999921321869},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3237000107765198},{"id":"https://openalex.org/C178823583","wikidata":"https://www.wikidata.org/wiki/Q3269883","display_name":"Online assessment","level":3,"score":0.29980000853538513},{"id":"https://openalex.org/C111874474","wikidata":"https://www.wikidata.org/wiki/Q6005872","display_name":"Impact assessment","level":2,"score":0.26660001277923584},{"id":"https://openalex.org/C95986675","wikidata":"https://www.wikidata.org/wiki/Q185168","display_name":"Quantitative analysis (chemistry)","level":2,"score":0.257999986410141},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.2538999915122986}],"mesh":[],"locations_count":4,"locations":[{"id":"doi:10.1145/3772318.3790409","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3772318.3790409","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2026 CHI Conference on Human Factors in Computing Systems","raw_type":"proceedings-article"},{"id":"pmh:oai:research.vu.nl:publications/abd83caf-a719-487e-98df-0c9cdb137863","is_oa":true,"landing_page_url":"https://research.vu.nl/en/publications/abd83caf-a719-487e-98df-0c9cdb137863","pdf_url":null,"source":{"id":"https://openalex.org/S4306401107","display_name":"VU Research Portal","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I865915315","host_organization_name":"Vrije Universiteit Amsterdam","host_organization_lineage":["https://openalex.org/I865915315"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":null,"raw_type":"info:eu-repo/semantics/conferenceObject"},{"id":"pmh:oai:repository.ubn.ru.nl:2066/331387","is_oa":true,"landing_page_url":"https://hdl.handle.net/2066/331387","pdf_url":"https://repository.ubn.ru.nl//bitstream/handle/2066/331387/331387.pdf","source":{"id":"https://openalex.org/S4306401067","display_name":"Radboud Repository (Radboud University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I145872427","host_organization_name":"Radboud University Nijmegen","host_organization_lineage":["https://openalex.org/I145872427"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"Article in monograph or in proceedings"},{"id":"pmh:oai:research.vu.nl:openaire/abd83caf-a719-487e-98df-0c9cdb137863","is_oa":true,"landing_page_url":"https://hdl.handle.net/1871.1/abd83caf-a719-487e-98df-0c9cdb137863","pdf_url":null,"source":{"id":"https://openalex.org/S4306401107","display_name":"VU Research Portal","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I865915315","host_organization_name":"Vrije Universiteit Amsterdam","host_organization_lineage":["https://openalex.org/I865915315"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"info:eu-repo/semantics/conferenceObject"}],"best_oa_location":{"id":"doi:10.1145/3772318.3790409","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3772318.3790409","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2026 CHI Conference on Human Factors in Computing Systems","raw_type":"proceedings-article"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.7304800748825073}],"awards":[{"id":"https://openalex.org/G3525686075","display_name":null,"funder_award_id":"RGPIN-2020","funder_id":"https://openalex.org/F4320334593","funder_display_name":"Natural Sciences and Engineering Research Council of Canada"},{"id":"https://openalex.org/G4929325685","display_name":"Theseus: Making patching happen","funder_award_id":"NWA.1215.18.006","funder_id":"https://openalex.org/F4320321800","funder_display_name":"Nederlandse Organisatie voor Wetenschappelijk Onderzoek"},{"id":"https://openalex.org/G510361925","display_name":"Cybersecurity for AI-Augmented Systems","funder_award_id":"101120393","funder_id":"https://openalex.org/F4320320300","funder_display_name":"European Commission"},{"id":"https://openalex.org/G7209445543","display_name":null,"funder_award_id":"KIC1.VE01.20.004","funder_id":"https://openalex.org/F4320321800","funder_display_name":"Nederlandse Organisatie voor Wetenschappelijk Onderzoek"},{"id":"https://openalex.org/G8362462119","display_name":null,"funder_award_id":"101120393","funder_id":"https://openalex.org/F4320334322","funder_display_name":"HORIZON EUROPE Framework Programme"}],"funders":[{"id":"https://openalex.org/F4320320300","display_name":"European Commission","ror":"https://ror.org/00k4n6c32"},{"id":"https://openalex.org/F4320321014","display_name":"Vrije Universiteit Amsterdam","ror":"https://ror.org/008xxew50"},{"id":"https://openalex.org/F4320321800","display_name":"Nederlandse Organisatie voor Wetenschappelijk Onderzoek","ror":"https://ror.org/04jsz6e67"},{"id":"https://openalex.org/F4320334322","display_name":"HORIZON EUROPE Framework Programme","ror":null},{"id":"https://openalex.org/F4320334593","display_name":"Natural Sciences and Engineering Research Council of Canada","ror":"https://ror.org/01h531d29"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":30,"referenced_works":["https://openalex.org/W384698140","https://openalex.org/W643044259","https://openalex.org/W1969785126","https://openalex.org/W2050453477","https://openalex.org/W2061141931","https://openalex.org/W2076646346","https://openalex.org/W2093504720","https://openalex.org/W2164317000","https://openalex.org/W2403232321","https://openalex.org/W2570094557","https://openalex.org/W3000845437","https://openalex.org/W3080878745","https://openalex.org/W3090957174","https://openalex.org/W3171557651","https://openalex.org/W3175201754","https://openalex.org/W3194135683","https://openalex.org/W4206283745","https://openalex.org/W4225756469","https://openalex.org/W4285112458","https://openalex.org/W4293235203","https://openalex.org/W4308643027","https://openalex.org/W4324129606","https://openalex.org/W4383900947","https://openalex.org/W4391818038","https://openalex.org/W4393145380","https://openalex.org/W4401722399","https://openalex.org/W4402264535","https://openalex.org/W4409361036","https://openalex.org/W4411120260","https://openalex.org/W4413240969"],"related_works":[],"abstract_inverted_index":{"Quantitative":[0],"vulnerability":[1,71,96],"assessment":[2,86,121],"is":[3,23],"central":[4],"to":[5,26,126],"security":[6,151],"management,":[7],"guiding":[8],"how":[9,68],"risks":[10],"are":[11,124],"prioritized":[12],"and":[13,22,31,63,73,100,106,146,153],"mitigated.":[14],"Yet,":[15],"severity":[16],"scoring":[17],"relies":[18],"on":[19,134,150],"human":[20],"judgment":[21],"therefore":[24],"subject":[25],"differences":[27],"in":[28],"experience,":[29],"interpretation,":[30],"diligence;":[32],"prior":[33],"work":[34,138],"has":[35],"even":[36],"shown":[37],"expert":[38],"disagreement.":[39],"We":[40],"examine":[41],"an":[42],"NLP-based":[43],"assistive":[44],"tool":[45,74,81,115],"that":[46,123],"visualizes":[47],"keyword":[48],"cues":[49],"during":[50],"assessment.":[51],"In":[52],"a":[53],"controlled":[54],"survey":[55],"of":[56,142],"389":[57],"participants":[58],"recruited":[59],"via":[60],"Amazon":[61],"MTurk":[62],"Prolific,":[64],"we":[65],"statistically":[66],"analyze":[67],"participant":[69],"skills/demographics,":[70],"characteristics,":[72],"support":[75,117],"affect":[76],"outcomes.":[77],"Results":[78],"show":[79],"the":[80,114,140],"does":[82],"not":[83],"consistently":[84],"improve":[85],"accuracy":[87],"across":[88],"expertise":[89],"levels,":[90],"but":[91],"can":[92,107,116],"help":[93],"for":[94,119],"specific":[95],"types":[97],"(e.g.,":[98],"CWE-787)":[99],"CVSS":[101],"metrics":[102],"(AC,":[103],"PR,":[104],"Scope),":[105],"increase":[108],"user":[109],"confidence.":[110],"Beyond":[111],"immediate":[112],"performance,":[113],"training":[118,152],"manual":[120],"tasks":[122],"hard":[125],"automate,":[127],"as":[128],"learning":[129],"effects":[130],"yield":[131],"significant":[132],"improvements":[133],"subsequent":[135],"tasks.":[136],"This":[137],"informs":[139],"design":[141],"cybersecurity":[143],"decision-support":[144],"tools":[145],"motivates":[147],"future":[148],"research":[149],"human-centered":[154],"security.":[155]},"counts_by_year":[],"updated_date":"2026-07-19T07:52:34.831488","created_date":"2026-04-14T00:00:00"}