# Helping CNAs Generate CVSS Scores Faster and More Confidently Using XAI
## 1 Introduction  
### Motivation  
In Information Technology (IT), vulnerabilities are weaknesses or flaws in a system, software, or hardware that can be exploited by attackers to gain unauthorized access or cause harm. As the world's dependence on technology grows, so does the complexity of the systems being used. Companies race to ship their products as quickly as possible, and this often leads to software and hardware of various types and versions being shipped together, as it is cheaper to maintain than to ensure everything is up-to-date. Naturally, this means that vulnerabilities, or cracks in the systems, eventually appear. Moreover, the exponential growth in technology usage and coverage results in a rapid increase in the number of vulnerabilities. Cybersecurity researchers, analysts, industry experts, and passionate developers all collaborate to find and fix these vulnerabilities by reporting each one they discover to organizations whose mission is to keep track of them. These organizations then work with trusted cybersecurity expert partners to analyze, evaluate, and score vulnerabilities. The score generated is then used to determine a vulnerability's severity level. This severity level is helpful for several use cases, most importantly the following:  
* Prioritizing vulnerabilities for remediation: Organizations can use the scores to prioritize which vulnerabilities to patch first, based on the severity of the vulnerability and the potential impact on the affected systems. * Communicating risk to stakeholders: Scores can be used to communicate the level of risk associated with a vulnerability to various stakeholders, such as executives, auditors, and customers, in a standardized manner. * Measuring and improving security posture: By tracking and analyzing the scores of vulnerabilities over time, organizations can gain insights into their overall security posture and identify areas for improvement in their vulnerability management processes. Having such an important impact, the generated scores must be accurate and precise, as a mistake can have disastrous consequences. This means that scoring organizations need to exercise extra caution, resulting in longer delays in the analysis. However, the number of reported vulnerabilities is growing at an alarming rate, making it increasingly challenging to cover them quickly while maintaining a high standard of quality for the analysis. Figure 1 illustrates this growth, depicting the number of vulnerabilities successfully reported and analyzed in the US National Vulnerability Database (NVD) from 1988 to March 2023. The graph demonstrates a significant upward trend that emerged rapidly in the early 2000s and experienced a sharp surge around 2017. As a result, analysts are confronted with larger influxes of vulnerabilities each year, which are becoming more complex as they encompass a wider range of technologies compared to previous years. This creates a dual burden, requiring analysts to stay up-to-date with the latest technologies, exploits, and remediation methods while conducting the analysis. Furthermore, the challenge is compounded by the fact that the total number of vulnerabilities is increasing, and their estimated severity level is as well. Further analysis of the data on which Figure 1 is based reveals an upward trend in vulnerabilities classified as medium, high, and critical. This growth is depicted in Figure 2, which highlights the severity distribution of these vulnerabilities from 2016 to March 2023. As the figure illustrates, it is the medium- to critical-severity vulnerabilities that continue to increase, placing additional stress on analysts. [PERSON] [1] analyzed the time it takes to complete the process of scoring a single vulnerability based on the same dataset and found that it can take up to several weeks, with more severe vulnerabilities causing longer delays. This is understandable, as scoring organizations would risk their reputation if their analysts were to misclassify vulnerabilities.