Looking forward to the adoption of the CVSS3 metrics at Cisco first and everywhere else next! One additional detail: I always found the cited text stated in our security advisories thoughtful and clear: "End users are encouraged to compute the environmental score based on their network parameters. The combination of all three scores should be considered the final score, which represents a moment in time and is tailored to a specific environment. Organizations are advised to use this final score to prioritize responses in their own environments. " But (still) wonder if the important active part really picked up by product teams and customers in their mitigation plans? Maybe we could offer a future blog with practical info together with sample extrapolations of such scores (accounting for environmental contributions)?