Standardized system for identifying and scoring software vulnerabilities, used to prioritize patches and assess an insured's patch-management maturity.
CVE (Common Vulnerabilities and Exposures) is a standardized catalog maintained by MITRE under US CISA funding, which assigns each known software vulnerability a unique identifier (for example CVE-2021-44228 for Log4Shell) together with a public description. CVSS (Common Vulnerability Scoring System) is a standardized scoring system that assigns each CVE a criticality score between 0 and 10, calculated on the basis of metrics such as exploitability, impact on confidentiality, integrity and availability, and whether or not user interaction is required. A CVSS score of 9 or above is classified as critical. These two systems form the backbone of patch management, the vulnerability-remediation process that consists of prioritizing the installation of vendor patches based on CVE criticality. For cyber underwriting, compliance with remediation deadlines for critical CVEs is a fundamental hygiene criterion. Some insurers use external-intelligence tools (attack-surface scanning) to detect whether the insured exposes systems carrying unpatched critical CVEs, which may constitute a ground for coverage denial or premium loading.
The Log4Shell vulnerability (CVE-2021-44228, CVSS 10.0) disclosed in December 2021 triggered a wave of notifications in the cyber sector: insurers sent urgent alerts to their insureds demanding immediate remediation, and some made renewal conditional on proof of patching.
CVE, CVSS, Common Vulnerabilities and Exposures, Common Vulnerability Scoring System, patch management