Patent Document ID: 8789192
Application ID: 13442636

Base Claim:
1. A method for generating a vulnerability score associated with en-information technology assets of an enterprise, said method comprising: collecting results of at least one vulnerability assessment conducted on the information technology assets by at least one vendor tool; analyzing each result for base score metrics, wherein steps of said analyzing each result for base score metrics comprising: retrieving National Vulnerability Database (NVD) information; when Common Vulnerabilities and Exposures (CVE) is present, retrieving base score metrics from an NVD repository; when Common Weakness Enumeration (CWE) is present and CWE is mapped to one or more CVEs, retrieving Common Vulnerability Scoring System (CVSS) base score metrics for associated one or more CVEs from the NVD repository; when CWE is present and CWE is mapped to one or more CVEs and a plurality of CVEs are retrieved, using CVSS base score metrics to generate a pseudo-CVE from retrieved CVEs when CWE is present and CWE is not mapped to one or more CVEs, using CVSS base score metrics to generate a pseudo-CVE based on result details; and when CVE is not present and CWE is not present, using CVSS base score metrics to generate a pseudo-CVE based on result details; analyzing each result for temporal score metrics; analyzing each result for environment score metrics; and generating a CVSS score for each result based on the base score metrics, temporal score metrics and environment score metrics for each result, wherein one or more of said steps of collecting results of at least one vulnerability assessment, analyzing each result for base score metrics, analyzing each result for temporal score metrics, analyzing each result for environment score metrics, and generating a CVSS score for each result are performed on a computer hardware platform having a processing module executing computer program code stored on a memory module of the computer hardware platform.

---

Claim 5:
5. The method of claim 1 wherein, in said analyzing each result for temporal score metrics, the temporal score metrics comprise one or more of an exploitability metric, a remediation level metric, and a report confidence metric.