## 9 Conclusions  
This paper presents a vulnerability management model that implements CVSS v3.x scoring and demonstrates its advantages over CVSS v2.0. Simulations carried out in selected test environments confirm that the previous standard, CVSS v2.0, lacks precision in environmental score assessments. All vulnerabilities were consistently classified as low severity, making the CVSS v2.0 environmental score insufficient to provide actionable information to ICT administrators. This critical limitation may result in the failure to promptly address all critical vulnerabilities and, in extreme cases, allow publicly known exploits to persist due to low CVSS v2.0 environmental scores. As a solution, we developed a vulnerability management model that adopts the CVSS v3.x standard instead of CVSS v2.0. This model utilizes specially tailored machine learning algorithms to convert CVSS v2.0 base scores into the newer standard, ensuring that vulnerabilities identified during scanning, regardless of their creation year, are assigned CVSS v3.x base scores. Consequently, ICT administrators can accurately calculate the environmental metrics for all vulnerabilities listed in the NIST NVD database. Simulations in our test environments demonstrate that, compared to CVSS v2.0, the utilization of CVSS v3.x environmental scores leads to a reduction in estimated work hours required to address critical vulnerabilities, thanks to a more accurate vulnerability prioritization. Our proposed model significantly improves remediation times between standards, with efficiency gains of up to 8%. Although the observed improvement in prioritization of 8% may appear modest as a standalone metric, the resulting risk reductions of 2.4% (34.1% to 31.7%) and 5% (34.1% to 29.1%) represent substantial operational impact when contextualized within cybersecurity economics. Given that cyber risk is calculated as the product of probability and impact, where impact often involves multimillion-dollar exposures, even modest percentage reductions translate to significant cost avoidance. The practical implications extend beyond direct cost savings. Even a digit decrease in exploitable vulnerabilities meaningfully narrows the attack surface available to threat actors, while these percentage improvements often exceed the demonstrable risk reduction thresholds required by regulatory frameworks and compliance standards. Furthermore, small percentage improvements in vulnerability closure rates compound temporally, creating progressively enhanced security postures through reduced mean time to remediation. Furthermore, our results indicate that the application of the CVSS v3.x standard effectively resolves the issue of categorizing all vulnerabilities as low priority when considering the environmental components of the CVSS score vector in all test environments studied. Thus, our findings highlight that the implementation of the CVSS v3.x standard enables ICT administrators to prioritize vulnerabilities more effectively and consequently improve risk assessment within their organizations. The main contribution to efficiency with the developed model is the ability to use the CVSS v3.x environmental score for all vulnerabilities. Adding environment context to the score allows us to adjust severity levels and, as a result, the priority of vulnerabilities. However, changes to priority scores in newer CVSS versions are more subtle and do not come with shortcomings like in previous versions. As shown in the research, the use of the CVSS v2.0 environmental score as a method of scoring priority management could introduce distorted images of vulnerability parameters \(TD\) and \(CDP\), making the standard unusable apart from specific cases including multiple deployments of the same components. Potential further improvement in the model is to include temporal scores that might alter the overall score even further.