## 8 Results
\begin{table}
\begin{tabular}{c c c c c} \hline \hline  & \(T_{FIX_{MIN}}\) & \(T_{FIX_{AVERAGE}}\) & \(T_{FIX_{MAX}}\) & **Mean \% Change** \\ \hline \(T_{base3}\) & 31 h & 136 h & 271 h & \\ \(T_{base3^{\prime}}\) & 32 h & 140.5 h & 280 h & \\ Difference & \(+1\) h (\(+3.23\%\)) & \(+4.5\) h (\(+3.31\%\)) & \(+9\) h (\(+3.32\%\)) & \(+3.29\%\) \\ \hline \(T_{base3}\) & 31 h & 136 h & 271 h & \\ \(T_{Ent3}\) & 30 h & 128 h & 254 h & \\ Difference & \(-1\) h (\(-3.23\%\)) & \(-8\) h (\(-3.8\%\)) & \(-17\) h (\(-3.8\%\)) & \(-5.12\%\) \\ \hline \(T_{base3^{\prime}}\) & 32 h & 140.5 h & 280 h & \\ \(T_{Ent3}\) & 30 h & 128 h & 254 h & \\ Difference & \(-2\) h (\(-6.25\%\)) & \(-12.5\) h (\(-8.90\%\)) & \(-26\) h (\(-9.29\%\)) & -8.15\% \\ \hline \(T_{base3 ML}\) & 48 h & 212.5 h & 424 h & \\ \(T_{base3 ML}\) & 49 h & 217 h & 433 h & \\ Difference & \(-1\) h (\(-2.08\%\)) & \(-4.5\) h (\(-2.12\%\)) & \(-9\) h (\(-2.12\%\)) & \(-2.11\%\) \\ \hline \(T_{base3 ML}\) & 48 h & 212.5 h & 424 h & \\ \(T_{Env3 ML}\) & 48 h & 209 h & 416 h & \\ Difference & 0 h (0.0\%) & -3.5 h (\(-2.6\%\)) & \(-8\) h (\(-2.5\%\)) & \(-1.18\%\) \\ \hline \(T_{base3 ML}\) & 49 h & 217 h & 433 h & \\ \(T_{Env3 ML}\) & 48 h & 209 h & 416 h & \\ Difference & \(-1\) h (2.04\%) & \(-8\) h (\(-3.69\%\)) & \(-17\) h (\(-3.93\%\)) & \(-3.22\%\) \\ \hline \hline \end{tabular}
\end{table} 
Table 5: The number of work hours required to remove significant security vulnerabilities in a tested ICT environment. for \(T_{base3}\) and \(T_{Env3}\) are compared, one can observe that the average gain of an estimated number of work hours decreases for all the cases considered and is equal to 8.15%. Furthermore, due to the prioritization of vulnerabilities according to the CVSS v3.x environmental score, the risk of using a fixed vulnerability by an attacker is equal to 29.1%. In the case of implementing the conversion of CVSS v2.0 to the CVSS v3.x standard with machine learning, the results obtained for \(T_{base3}\) and \(T_{base3 ML}\) show an increase in the number of estimated work hours by 51% due to the increase in the number of vulnerabilities evaluated. Furthermore, implementing the conversion of the CVSS v2.0 base score to the CVSS v3.x base score reduces the risk of using the fixed vulnerability of an attacker from 34.1% to 2.4%. Finally, prioritizing according to the CVSS v3.x environmental score, the risk of not fixing the vulnerability that an attacker may use is reduced from 34.1% to 2.4% compared to the CVSS v2.0 standard. Using the time required to achieve this fix might not offer a clear understanding of the vulnerabilities, yet prioritization of tasks in organizations might be tied to the effort required for mitigations. Based on the results, one might conclude that the use of the CVSS v2.0 environmental score could result in an underestimation of vulnerabilities and the production of residual risk. However, without calculating the base score using the v3.x standard, there will not be a possibility to use a finer solution, the CVSS v3.x environmental score. Using proposed Machine Learning, and assigning CVSS v3.x base score to vulnerabilities without them assigned allows operator to properly assign effort and prioritization for vulnerabilities.