A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →CVSS, the Common Vulnerability Scoring System, is an open framework for rating the severity of a security vulnerability on a scale from 0.0 to 10.0. The score is derived from factors like how a flaw is exploited and the impact on confidentiality, integrity, and availability. Higher scores indicate more severe vulnerabilities.
CVSS bands map to labels: 0.1 to 3.9 is low, 4.0 to 6.9 medium, 7.0 to 8.9 high, and 9.0 to 10.0 critical. Teams use these scores to decide what to patch first.
The base score reflects the flaw in isolation; it is not a complete picture of your risk. A "critical" CVE on a system with no network exposure may matter less than a "medium" on an internet-facing one, which is why context still drives prioritization.
traztech delivers vulnerability triage and prioritization for startups and growth-stage companies, led by a published security researcher.
Book a callFor a broader look at getting audit-ready, see our SOC 2 readiness work, or talk to a fractional CISO about building a program around it.
Free PDFs, no card
SOC 2 readiness, ISO 27001 gaps, incident response and vendor security, as PDFs you can print or forward. Free, no card.
From Jacob Masse, principal of traztech: the files by email, then a few short notes over the next month. No spam, unsubscribe in one click.
CVSS scores drive remediation SLAs in most vulnerability management policies, which is where they meet compliance: an auditor will compare your stated timeframe against what actually happened.
The trap is treating the base score as the risk. A 9.8 on a component you do not expose is less urgent than a 6.5 on your authentication path, and a policy that cannot express that produces either panic or ignored alerts.
No. CVSS base scores describe the vulnerability, not your environment. Exploitability in your specific configuration and exposure should drive the priority.
Whatever you can genuinely meet. Auditors compare your policy against your evidence, so a realistic thirty-day critical SLA you hit beats a seven-day one you miss.