Not all vulnerabilities are equal to each other, and so each vulnerability is placed in a category of risk adjudicated by the CVSS calculator.

There are three metric groups that make up the CVSS, which we will be studying in detail in the following topics.