What's wrong with embracing standards already in place like CVSS? And an exploitability index should not be a predictor for malware - just a measurement of whether malware could be exploited - not a be whether it will.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/newsbriefs/856/2703#2703