What's wrong with embracing standards already in place like CVSS? And an exploitability index should not be a predictor for malware - just a measurement of whether malware could be exploited - not a be whether it will....

[ more ]