## 8 Results
Figure 5: The number of vulnerabilities modified for a given difference value between CVSS v2.0 base score and CVSS v2.0 environmental score for the tested ICT environment. To analyze the properties of the proposed vulnerability management model presented in Section 3 and Figure 1, scanning results without assigning a CVSS v3.x base score were processed using the machine learning converter discussed in Section 5. Translation allowed all vulnerabilities to be assigned a CVSS v3.x base score. As a result, CVSS v3.x environmental score assignment was possible for all vulnerabilities. Upon analyzing environmental parameters for the CVSS v3.x base score, two cases were distinguished. One consists of using machine learning methods to convert CVSS v2.0 base scores to CVSS v3.x ones when a newer standard is unavailable. The second case involves no use of the machine learning converter when the CVSS v3.x base score is available. Figure 6 shows the number of detected vulnerabilities categorized by severity according to the CVSS v3.x base score and the environmental scores for the ICT environment tested. The results of Figure 6 show significant changes between the CVSS v3.x base score and the environmental one. An increased number of critical vulnerabilities and a decrease in the number of high vulnerabilities is also observed. This is mainly due to the environmental parameters \(C\), \(I\), and \(A\). Figure 7 shows the number of all changes in the value of the CVSS v3.x environmental score when referring to the CVSS v3.x base score. The environmental parameters \(C\), \(I\), and \(A\) modified base scores in the range from \(-2.1\) to \(1.9\), which made up 51% of all detected vulnerabilities, while the environmental parameters \(C\), \(I\), and \(A\) modified 38 base scores in the range from \(-2.1\) to \(1.9\), which corresponds to 48.1% of all detected vulnerabilities. \begin{table}
\begin{tabular}{c c c c c} \hline  & \(\mathbf{T_{FIX_{MIN}}}\) & \(\mathbf{T_{FIX_{NFERAGE}}}\) & \(\mathbf{T_{FIX_{MAX}}}\) & **Mean \% Change** \\ \hline \(T_{\text{bsd}2}\) & \(53\) h & \(238.5\) h & \(477\) h & \\ \(T_{\text{bsd}2}\) & \(57\) h & \(256.5\) h & \(513\) h & \\ Difference & \(+4\) h (\(+7.5\%\)) & \(+18\) h (\(+7.5\%\)) & \(+36\) h (\(+7.5\%\)) & \(+7.5\%\) \\ \hline \(T_{\text{bsd}2}\) & \(53\) h & \(238.5\) h & \(477\) h & \\ \(T_{\text{Etr}2}\) & \(3\) h & \(3\) h & \(3\) h & \\ Difference & \(-50\) h (\(-94.3\%\)) & \(-235.5\) h (\(-98.7\%\)) & \(-474\) h (\(-99.4\%\)) & \(-97.4\%\) \\ \hline \(T_{\text{bsd}2}\) & \(57\) h & \(256.5\) h & \(513\) h & \\ \(T_{\text{Etr}2}\) & \(3\) h & \(3\) h & \(3\) h & \\ Difference & \(-54\) h (\(-94.7\%\)) & \(-253.5\) h (\(-98.8\%\)) & \(-510\) h (\(-99.4\%\)) & \(-97.6\%\) \\ \hline \end{tabular}
\end{table} 
Table 2: The number of work hours required to remove a significant security vulnerability for a tested ICT environment. Figure 6: The number of detected vulnerabilities for each severity category according to the CVSS v3.x base score and environmental score. Table 3 shows the number of changes in severity category with \(CIA\) between the CVSS v2.0 base score and the CVSS v3.x base score (calculated using machine learning). The most significant change in detected vulnerabilities was observed for the critical (+2) and high (\(-2\)) categories. Table 4 shows the number of changes regarding the severity category when the \(C\), \(I\), and \(A\) environmental parameters are considered. This time the results do not include the conversion mechanism of the CVSS v2.0 base score to the CVSS v3.x base score using machine learning, which means that the vulnerabilities with no CVSS v3.x base score, are not considered. The most significant change in the number of detected vulnerabilities was recorded for critical (+5) and high (\(-5\)) categories. Table 5 shows the number of work hours needed to remove significant vulnerabilities from tested ICT environments.