> I can look at a CVE and determine for myself and my organization whether it something we need to care about. Yes, but one can envision a scenario where ever

> I can look at a CVE and determine for myself and my organization whether it something we need to care about. Yes, but one can envision a scenario where everything gets a CVE number and you, or members of your team, spend an inordinate amount of time looking up CVE numbers. Then along comes a service that you have to pay for that scores each CVE number for you. Due to any lack of discretion (in a database maintained by "experts"), you'll pay with your time, or your money.