When the Same Cyberattack Scores Higher

TL;DR for operators

A vulnerability score can describe the technical severity of a cyberattack without fully representing who depends on the affected infrastructure. Barletta et al. propose a scoring extension that adds affected people, organizations, and operational locations to conventional cybersecurity assessment.

Across four simulated attacks, three receive higher severity scores under the proposed system. These increases demonstrate how the new calculation behaves, not that it predicts real-world harm more accurately.

For critical-infrastructure operators, the framework offers a structured way to incorporate service dependencies and stakeholder exposure into risk reviews. Its digital twin can reproduce selected technical attacks, and an LLM can prepare preliminary assessments. However, the social-impact assignments, AI outputs, and proposed human-approval process still require validation before they can reliably determine operational priorities.

A higher score for the same incident

A security team facing a service outage, a compromised customer-support application, and malware affecting industrial operations must decide which incident deserves attention first. Severity scores help organize that decision. Yet two incidents with similar technical consequences may affect very different numbers of people, organizational functions, or essential services.

A score that overlooks these dependencies can leave significant consequences outside the formal assessment. Adding them, however, creates another question: does the revised score measure additional harm, or merely express additional assumptions about harm?

In A Digital Twin to Improve Cyber-Social Impact, Barletta et al.¹ examine this question through an extension of the Common Vulnerability Scoring System (CVSS v3.1). Their proposed Cyber-Social Vulnerability Scoring System (CSVSS) incorporates social exposure into the severity calculation.

The reported results show how much this adjustment changes the scores.

Source: Section 6, Table 2. Scores are on a 0–10 scale.

Three scores increase, while ransomware remains at the maximum. The numerical differences arise from changing the scoring framework and assigning additional impact values to the same scenarios.

Ransomware also illustrates a measurement constraint: once a score reaches 10.0, additional modeled severity cannot increase its reported value. Two incidents receiving the maximum may still differ substantially in their consequences and operational urgency.

The comparison establishes that CSVSS responds to the added impact dimensions. It does not establish that the resulting rankings better match actual societal damage.

Entity and Place make social exposure part of the calculation

Conventional CVSS v3.1 assesses technical consequences through confidentiality, integrity, and availability. These dimensions describe whether information is disclosed, systems or data are altered, or services become unavailable.

CSVSS extends this familiar CIA structure with two dimensions, producing the CIAEP model:

• Entity (E): The people, organizations, and operational roles affected by an attack.
• Place (P): The geographic or operational extent over which consequences propagate.

Each receives one of three severity values:

Source: Section 3, Table 1; descriptions condensed from the authors’ assignment criteria.

The system defines Social Impact as:

It therefore uses whichever of Entity or Place receives the higher severity. An incident with High impact on one dimension cannot be reduced to Low by the other dimension.

The resulting Social Impact enters a four-component impact calculation:

This retains the multiplicative complement structure used in CVSS while introducing a fourth impact component.

The framework also preserves CVSS v3.1’s technical exploitability factors and its distinction between Unchanged and Changed Scope. Scope identifies whether exploitation crosses a security-authority boundary; Entity and Place describe the reach of consequences. These are separate questions.

For Changed Scope, the authors additionally adjust the impact function’s corrective-term exponent from 15 to 30. This is a mathematical calibration intended to accommodate the expanded impact calculation, not a parameter estimated from observed social outcomes.

These choices have consequences for interpretation. Taking the maximum makes the scoring conservative with respect to either social dimension, but it does not distinguish two simultaneous High classifications from one High and one Low classification. Nor does it capture uncertainty about how many people will actually be affected.

CSVSS makes judgments about societal exposure explicit and reproducible within its rules. The validity of those judgments remains a separate empirical question.

The digital twin reproduces attacks, not their complete consequences

Testing disruptive cyberattacks directly against critical infrastructure can be unsafe or operationally impractical. The researchers therefore construct a virtual industrial IT/OT environment using Mininet for network emulation and MiniCPS for industrial control-system simulation.

The synthetic topology includes enterprise services, networking infrastructure, a VPN boundary, and operational components. Four selected attacks produce observable technical outcomes.

The DoS scenario demonstrates service degradation. XSS produces malicious script execution. The ransomware test encrypts 1,002 small test files, totaling approximately 16 KB, in 0.16 seconds. Kurtlar.exe produces an unauthorized VNC authentication outcome.

These observations support the feasibility of the experimental environment for demonstrating selected attack behaviors.

They do not independently establish the corresponding effects on populations, industrial production, or essential-service availability. The fictional infrastructure contains no measured real-world societal outcomes against which to validate Entity and Place assignments.

The ransomware example makes the boundary particularly clear. Its experiment implements file encryption while assuming the initial compromise. The assigned confidentiality severity is High, although the reported test primarily establishes encryption rather than independently measured data exfiltration.

The four cases are demonstrations, not representative samples of industrial incidents. Consequently, they cannot show how frequently CSVSS would improve rankings across an operational vulnerability portfolio.

AI-assisted assessment still needs tested decision controls

The architecture also incorporates Mistral 7B to support initial vulnerability analysis. Given scenario-specific prompts and available logs, the model assists with CAPEC attack-pattern identification, CWE vulnerability mapping, preliminary CVSS assessment, and structured risk reports.

This provides a plausible division of work: software generates technical evidence, an LLM organizes preliminary interpretations, and security personnel retain responsibility for consequential decisions.

The authors propose a human-validation gate for critical assessments. But the study does not experimentally test whether analysts catch model errors, whether approvals are consistently applied, or whether collaboration improves decisions.

Neither are systematic measurements of LLM classification accuracy, response consistency, report reliability, or analyst time savings reported.

The operational concern is that a classification error can propagate into a numerical score and then into an escalation decision. A formally calculated score can be precise even when its underlying impact classification is unsupported.

What would justify using CSVSS for operational prioritization?

For a critical-infrastructure operator, the relevant business question is whether the additional social dimensions change remediation or escalation decisions in ways supported by reliable evidence.

Cognaptus inference: CSVSS is best evaluated initially as a supplementary assessment alongside conventional CVSS, rather than as an immediate replacement for existing vulnerability priorities.

A controlled pilot could retain conventional severity scores, document Entity and Place assessments, and compare the resulting rankings against established operational dependencies. It should test:

1. Classification validity: Can assigned Entity and Place levels be supported by service-dependency records, affected-user information, and independently documented consequences?
2. Ranking stability: Do reasonable differences in classifications materially change which incidents receive remediation resources or executive escalation?
3. AI reliability: Does LLM assistance reproduce correct classifications and reports consistently, including when relevant evidence is incomplete?
4. Decision governance: Can designated approvers identify unsupported claims and prevent unreliable automated assessments from determining consequential actions?

The pilot would be most informative when it examines cases in which the conventional and expanded scores produce different operational priorities. Those disagreements reveal whether the added dimensions contribute information that decision-makers can verify.

Score saturation deserves separate attention. If several incidents reach 10.0, their social consequences may need to remain visible as individual dimensions rather than being compressed into a single maximum value.

This approach connects the proposed measurement system to business-continuity planning without assuming that a larger severity number automatically produces a better decision.

The remaining gap is validation against consequences

The study demonstrates an implementable cyber-social scoring framework, selected technical attack simulations, and an LLM-assisted analysis pipeline. Those are meaningful system-design contributions.

The outstanding evidence concerns whether the assigned social-impact categories correspond to actual consequences, whether the modified scoring function improves operational prioritization, and whether AI-assisted assessments with human approval are reliable in practice.

For organizations responsible for essential services, Entity and Place provide a disciplined vocabulary for consequences that technical vulnerability scores may leave implicit. Their value will depend on the quality of the evidence used to assign them and whether those assessments improve decisions under real operational constraints.

A higher severity score can change what receives attention. It should earn that influence through demonstrated decision quality, not through the additional variables in its formula alone.

Cognaptus: Automate the Present, Incubate the Future.