## 3 Related Work: Vulnerability Management Models  
Many research teams have paid attention to the problem of vulnerability prioritization [30; 31; 32; 33]. Most established organizations, with a strong focus on cybersecurity, implemented the vulnerability management process to a greater or lesser extent [30; 34; 35]. However, as clarified in [30; 31; 32; 33; 35], each organization differs in its approach to vulnerability management. Solutions presented in [36], such as F-Secure [37], Qualys [38], Rapid7 [39] or Tenable [40], are products that address major problems in vulnerability management and provide custom-made solutions to address vulnerabilities. However, these commercial solutions do not disclose the details of vulnerability prioritization procedures [41]. Alongside commercial solutions, there is a large portion of open-source projects in the area of vulnerability prioritization, such as PatchRank [42], Vulcon [43], CMS [44], CAVP [45], or VEST [46]. However, none of these solutions [42; 43; 44; 45; 46] offers prioritization according to the CVSS v2.0 and CVSS v3.x standards [6; 7; 12]. This is because the majority of CVSS v2.0 base scores have not been converted to the CVSS v3.x standard until now. An important aspect of vulnerability prioritization that should be emphasized concerns the organizations that use metrics submitted by the Center for Internet Security (CIS). These metrics were created in 2010 [47] to measure the security level of the ICT infrastructure. In order to meet the requirements of CIS metrics, organizations most frequently choose a standard considering the CVSS v2.0 base score, excluding the CVSS v3.x model, due to a lack of availability of the CVSS v3.x base score for all vulnerabilities. Furthermore, according to several independent researchers [34; 48; 49], vulnerability management models that rely solely on the base score are inadequate. The time characteristic was tested mainly by [PERSON] in [50], while the environmental characteristic was analyzed by researchers who aimed to estimate the risk value, the potential loss and the prevalence of affected systems within the discussion environment. An additional context of the environment is essential to accurately estimate the security level. Hence, in most recent papers, the importance of the CVSS v3.x environmental score calculation is stressed. Thus, in [5], the authors pursued the route of combining both CVSS v2.0 and CVSS v3.x standards to at least take advantage of the improved accuracy of the CVSS v3.x standard in cases where the CVSS v3.x base score is known, while in [6; 7] a machine learning tool was developed to convert base scores from CVSS v2.0 to the CVSS v3.x standard. Extending our previous vulnerability management research [5; 41; 51], this paper presents the Vulnerability Management Center (VMC), a scalable cloud-based distributed system. A key function of VMC is to aggregate vulnerability data from public sources and internal ICT networks (using scanners such as Nessus [52]) and correlate it with inventory data. Specifically, this paper details the application of VMC in two crucial areas: translating CVSS v2 scores to CVSS v3.1 scores and subsequently calculating CVSS v3.1 environmental Scores to provide a more accurate and context-aware vulnerability assessment and prioritization. Thus, using machine learning methods, we are able to fully implement CVSS v3.1 in the vulnerability management process. The main contribution of this paper that goes beyond the previously published work consists of implementing CVSS v3.1 in selected test environments and evaluating the potential benefits compared to CVSS v2.0. Having described the main contribution of this paper, we now describe the methodology used in this research. The next section also gives a more detailed description of the novel aspects of the presented work. First, we outline the methodology used for the calculation of CVSS scores in a given environment.