Is a CVSS score the same as risk?

No. It is one input. Risk also depends on the asset, exposure, business impact, threat activity and existing controls. A 9.8 on an isolated lab host is not the same business risk as a 7.5 on a payment service.

Free tools · Security

CVSS v3.1 base score

Build a vector, see the base score and read the severity band. This is the score the exam expects you to reason about, not a verdict on business risk.

Metrics

CVSS v3.1 base

Attack vector

Attack complexity

Privileges required

User interaction

Scope

Confidentiality

Integrity

Availability

Practice this in the app

Free to start. No card.

Read the vulnerability scoring lessonCySA+ path: prioritising findings Try a triage labRank findings with exposure and impact

Questions

It is a severity score from 0 to 10 for the intrinsic properties of a vulnerability: how it is reached, how hard it is to exploit, what privileges or user action it needs, and what it affects. The base score does not change when the vulnerability is fixed or when a particular organisation has compensating controls.

Scoring is the start of triage, not the end

CySA+ and Security+ questions ask what to fix first. SecLern labs give you findings, exposure and a clock, then grade the decision.

Start studying free

Free tier, no card. Pro starts with a 7-day trial; a card is required and you can cancel before day 7.