## 8 Results  
This section presents the results obtained from the vulnerability management process conducted in selected test environments. Figure 3 illustrates the distribution of vulnerabilities assessed in severity categories using both the CVSS v2.0 and CVSS v3.x base models, including environmental scores. Figure 4 shows the matrix of the output of the vulnerability category classification for the conversion of the CVSS v2.0 base score to CVSS v3.x, which was the result of algorithms previously presented applied to 71,000 vulnerabilities obtained from NVD [1]. The numbers on the vertical and horizontal axes have the following meaning: 0--informational; 1--low; 2--medium; 3--high; 4--critical. These results show that the applied solution obtains the best result in the critical category (precision 90.3%, sensitivity 87.8%) and the worst in the low category (precision 27%, sensitivity 12.4%) for CVSS v3.x. In particular, only class 2 vectors were incorrectly assigned to the information category. One might conclude that the method prefers to overestimate the vulnerability category for class 1 (low) and class 2 (medium), classified respectively as medium and high, which, from the point of view of the IT security system, represents a safer solution than an underestimation. In the case of classes 2 (medium) and 3 (high), most misclassification occurs within adjacent categories. In 8.55% of the cases, they were incorrectly assigned to class 3 (high), instead of class 2 (medium), and the category of 3.81% of the rest of the cases was underestimated. Taking into account class 3 (high), about 12.30% of the cases were assigned a lowered category, while 3.54% were assigned a critical category. Finally, considering the results shown in  
Figure 3: The number of detected vulnerabilities for each severity category according to CVSS v2.0 base and environmental score for the tested ICT environment. Figure 4, one can see that the average accuracy for the classification of all categories is equal to 85.52%. The misclassification patterns observed in Figure 4 can be attributed to several key factors. Poor performance in the low category (precision 27%, sensitivity 12.4%) is mainly due to fundamental differences in scoring methodologies between CVSS v2.0 and v3.x standards. Specifically, CVSS v3.x introduces finer-grained metrics such as Privileges Required (PR) and User Interaction (UI), which were not present in CVSS v2.0. Vulnerilities that scored low in CVSS v2.0 due to limited metric precision may legitimately deserve higher scores under the more nuanced evaluation of v3.x. The introduction of the scope parameter \(S\) in CVSS v3.x fundamentally changes the way impact is calculated, particularly for vulnerabilities that affect multiple components, i.e., a changed scope. The disproportionate representation of categories (1:39:30:20:11 for corresponding severity categories) potentially creates a bias toward over-representation of medium and high categories, explaining why the algorithm tends to overestimate rather than underestimate severity. Some effects might also be due to the over-representation of higher-scored vulnerabilities--typically, it is less likely for lower vulnerabilities to be added to vulnerability databases. The data illustrated in Figure 3 reveal a significant limitation of the CVSS v2.0 environmental score: Throughout, all identified vulnerabilities were consistently classified as low severity, even those with high base scores. Further analysis indicates that the Temporal Difference (TD) parameter was the primary factor contributing to these low environmental scores [5]. Since none of the scanned vulnerabilities affected more than 25% of the machines in the studied environments, the TD parameter was uniformly assigned a low value (TD:L). Consequently, the impact of other environmental parameters--Collateral Damage Potential (_CDP_), Confidentiality (C), Integrity (_I_), and Availability (_A_)--on the resulting severity categorization was minimal.