While still in the public comment phase, I'm of the opinion that CVSS 4.0 scoring will be a huge improvement in how organizations can make decisions on risk. It looks like we could benefit from the proposed metrics to contextualize actual exploitability, and how it applies to critical areas such as OT/ICS and even healthcare. https://www.first.org/cvss/v4-0/