CVSS Vector Strings, Explained
How to read a compact CVSS v3.1 vector string like CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Why It Matters
The vector string is the portable, unambiguous representation of a CVSS score — two people (or two tools) computing the same score from the same vector will always agree, which a single numeric score alone doesn't guarantee without the underlying metrics.
Application to Application Security
Reading a vector string directly tells you, without opening a calculator, whether a finding is network-reachable and unauthenticated (AV:N/PR:N) — the combination that typically warrants the fastest response.
Relation to Software Development
Engineers who can read a vector string at a glance can triage a finding queue faster than ones who only look at the final numeric score, since the components tell you *why* a score is what it is.
How Strata Surfaces This
Every finding with an automatically calculated CVSS score includes its full vector string alongside the numeric result, not just the number alone.
Developer guidance
Learn to scan AV and PR first when triaging a finding queue — those two metrics alone tell you whether something is remotely, unauthenticated-ly reachable, which is usually the fastest priority signal.
Management guidance
A vector string is worth including in any report shared with engineers, even if the summary for non-technical stakeholders only shows the numeric score.