Thanks for a really good explanation and I think CVSS v3 scores will more accurately reflect the impact of security issues on our customers. For example, we had a vuln in one of our switches which severely affected adjacent nodes in the network while the switch with the vuln was not affected. Under CVSS v2 the severity was 5.x but I think with CVSS v3 the environmental score would pull up the overall score.