Separate severity, likelihood, and local repair priority

Establish the claim first

Identify the affected asset and version, the observation supporting the finding, and the confidence appropriate to that evidence. A version match may justify investigation without proving that a particular attack path is reachable. Conversely, a reproduced application behavior may require an engineering response even when there is no convenient identifier for the underlying flaw.

Retain the assessment method, configuration, access, and date. If the evidence depends on an authenticated check, establish that the account was usable. If it depends on a package or component record, connect that record to the asset actually deployed.

Read the score with its assumptions

FIRST's CVSS v4.0 specification describes a severity-scoring system. Preserve the vector and the reasoning behind the selected metrics when a CVSS score is used. A number without those assumptions is difficult for another reviewer to assess.

FIRST's EPSS FAQ describes a different model concerned with exploitation probability for published vulnerabilities. It is not another name for technical severity, and a probability for an identified vulnerability is not a verdict about every weakness in an application.

Add the local operating context

The repair decision also depends on exposure, the data and operations at risk, available controls, the reliability of the evidence, and who can deliver the change. Keep those facts beside the technical claim. An internet-facing application and an isolated lab can share a component identifier while presenting different operating decisions.

Do not manufacture a numerical business-risk score when the supporting inputs are absent. A specific statement such as “the affected service is externally reachable and the owner can deploy the vendor fix this week” may be more actionable than an unexplained composite ranking.

Preserve uncertainty without losing ownership

Use a clear state for unresolved evidence, missing access, an accepted exception, and a confirmed repair. A disputed finding still needs a next step and a responsible reviewer. Suppressing it is different from proving it false.