## 4 Methodology  
To assess the performance of machine learning algorithms in converting CVSS v2.0 scores to CVSS v3.x, two distinct ICT environments were artificially constructed and scanned using the Nessus vulnerability scanner (Tenable, Inc., Columbia, Maryland). Nessus was selected for its extensive plugin library, which allows the detection of a wide range of vulnerabilities, supporting both CVSS standards. The environments were designed to replicate real-world ICT infrastructures without exposing operational systems to risk. The first environment comprised 23 servers, while the second contained 15 servers, each offering various services, including product development and back-office operations. Machine learning algorithms were trained on this dataset to automate the conversion from CVSS v2.0 to CVSS v3.x. The performance of the vulnerability management models was evaluated by comparing the times related to mitigating problems prioritized using different models. The two environments, which feature a diverse range of vulnerabilities, enabled a comprehensive evaluation of the generalizability and effectiveness of the models across different network configurations. We then calculate the environmental CVSS v3.x score for all identified vulnerabilities, allowing the elimination of the CVSS v2.0 environmental score from the prioritization process and consequently the removal of the \(TD\) parameter, which addresses the inherent issues of the CVSS v2.0 standard. The proposed vulnerability management model, illustrated in Figure 1, begins with a vulnerability scan conducted using the Nessus scanner. The results are fed into a CVSS base score calculation module. For vulnerabilities where only the CVSS v2.0 base score is available, a machine learning converter is used to calculate the CVSS v3.x base scores [6; 7]. Once all base CVSS v3.x scores are obtained, an initial prioritization is performed. In the subsequent step, information from the asset database is utilized to compute the CVSS v3.x environmental scores for all vulnerabilities. The process of assigning environmental metrics might be achieved with VMC in an automated manner, altered by the operator by adjusting the Impact Subscore Modifiers: confidentiality, integrity and availability requirements for CVSS v3.x environmental metrics. It is also possible to alter other parameters of the environmental score in order to adjust the base CVSS v3.x score using modifiers from the environmental score. After this calculation, the final prioritization is performed. The process ends with decisions on the handling of detected vulnerabilities, broadly classified as vulnerability mitigation in Figure 1, which may involve actions such as updating to non-vulnerable versions or applying patches. The use of artificially constructed environments in this study provides a controlled and representative setting to evaluate the proposed methodology. Although these environments are not live production systems, they are designed to reflect key characteristics of real-world ICT--testing environments effectively mimic production systems by replicating key infrastructure components, including hardware specifications, server configurations, network topology, and software versions, while implementing production-like datasets through data masking techniques, identical security policies, deployment processes, and monitoring systems. This approach ensures that the identified vulnerabilities, as well as their categorization under both CVSS standards, are consistent with those found in operational networks. By replicating common server and service setups, artificial environments are capable of capturing a broad spectrum of potential vulnerabilities, providing a reliable basis for assessing the performance of machine learning models. In addition, the controlled nature of these environments allows for a focused and risk-free evaluation of the proposed method. In production systems, the scanning process could introduce risks, such as potential downtime or unintended impacts on operational services.