In reply to Stefan Hagen.

That is a really good suggestion, Stefan! I will consider it for a future article.

What I am seeing nowadays -- after talking to several customers and folks in the industry that consume our (and any other vendor) vulnerability reports -- is that not a lot of people use /calculate environmental scores. Mostly because of scalability reasons (i.e., due to the number of vulnerabilities that they have to process). They only pay attention to the base score and in some cases just at the Qualitative Severity Rating (what we call Security Impact Rating); which is whether the vulnerability base score is considered critical, high, medium, or low.