Let's be fair, CVSS scores aren't helpful. They're lightning strike metrics. They tell you how bad it is if you're struck by lightning (as well as allow for alarmist security journalism) but they don't cover impact on the internet at large.

NIS2 is here, and is making some very specific demands. Those countries that don't have one yet need to set up a National Cybersecurity Center, and those that do need to engage in a higher level of cooperation than ever before.

Delivered:
@ Disarray 2025 in Turku/Stockholm