The common vulnerability scoring system is a valuable tool, but how strictly should medical organizations rely on it? When assessing medical and healthcare technology, does it bring enough information, or does it fall short?