Are you speaking from your experience in vulnerability management? If anything, I’ve seen the opposite behavior (ignore everything except where the risk is crit

Are you speaking from your experience in vulnerability management? If anything, I’ve seen the opposite behavior (ignore everything except where the risk is critical). CVSS has been around since the mid-2000s, so it isn’t as if there’s no way to discern critical vulnerabilities from informational ones.