iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
“Zero” can describe three different conditions in a vulnerability filter: a CVSS score of 0, zero findings returned by a query, or no score assigned at all. Treating those states as interchangeable can hide unassessed assets, unsupported software, skipped checks, or simply a policy boundary. A trustworthy interface reports the matching result and assessment coverage separately, preserves missing scores as missing, and documents exactly how thresholds behave.
Start with the three meanings of zero
A CVE is an identifier for a publicly disclosed vulnerability. CVSS is a scoring system used to describe the vulnerability’s severity. A filter may therefore be operating on CVE records, findings produced by a scanner, or CVSS values attached to those records. The first design decision is to represent the possible states distinctly.
A numeric CVSS score of 0
CVSS v4.0 assigns a numeric score from 0 through 10. A numeric 0.0 is a real, assigned score at the bottom of that range. It is data: a scoring authority evaluated the vulnerability and produced a vector and score. The score should remain associated with its CVSS version, vector, source and metric group.
Free tools Windows power users keep installed
One-click scans. No signup required.
A zero score does not mean that a CVE record is absent, that the affected software is not installed, or that an organization has no exposure. It describes the severity assessment represented by that particular score. The official CVSS v4.0 User Guide from FIRST.Org, Inc. states: “CVSS Base (CVSS-B) scores are designed to measure the severity of a vulnerability and should not be used alone to assess risk.”
#1 Best Overall
- BOLD CYBERSECURITY DESIGN: Features the phrase 'Vulnerability Scanner by Day Ninja by Night' with striking alert icons and exclamation marks printed on both sides of the mug.
- HIGH-QUALITY CERAMIC: Crafted from durable white ceramic material, this 11 oz mug is built to withstand daily use at home or in the office.
- MICROWAVE & DISHWASHER SAFE: Designed for convenience, this lightweight mug is both microwave and dishwasher safe for easy cleaning and reheating.
- PERFECT GIFT FOR TECH PROFESSIONALS: An ideal gift for cybersecurity analysts, IT professionals, or any tech enthusiast who takes pride in their work.
- COMPACT SIZE: Measures 3.8 inches tall and 3.3 inches wide, making it a great fit for standard cup holders, desks, and kitchen cabinets.
No score assigned
A record can exist without a CVSS score. An API may represent this as null, a missing field, an empty value, or an explicit “unscored” state. That condition is not numerically equal to zero. Sonatype’s policy documentation puts the distinction plainly: “A CVSS score of 0 indicates ‘no exploitable risk,’ while a null value means that no CVSS score has been assigned. These are not the same: null ≠ 0.” The wording is Sonatype’s policy interpretation, not a universal replacement for the CVSS specification.
Keep the reason for an unscored record when it is available: for example, no assessment has been published, the source has not imported one, or the selected CVSS version is unavailable. If the reason is unknown, label it as unknown rather than manufacturing a zero.
Zero findings returned
“Zero findings” is a query result, not a score. It means that, after the system applied the selected scope, filters and threshold, no returned item matched. A zero-row result can occur when an assessment is complete and no item meets the condition. It can also occur when discovery is incomplete, software identity could not be mapped, checks were skipped, data is stale, or the query excluded the relevant assets.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches| State | What it says | What it does not establish |
|---|---|---|
| CVSS score = 0 | An assigned numeric severity value at the bottom of the CVSS range | That the vulnerability is absent, harmless in every environment, or irrelevant to local risk |
| CVSS score = null or missing | No score is available in the selected data source or version | That the score is zero or that the vulnerability has no severity |
| 0 findings returned | The current query produced an empty result set | Universal absence of vulnerabilities or complete assessment coverage |
Why a CVSS number is not the whole risk decision
CVSS v4.0 organizes information into Base, Threat, Environmental and Supplemental metric groups. Base metrics describe intrinsic characteristics of a vulnerability. Threat metrics can reflect circumstances such as exploit maturity, while Environmental metrics adapt the assessment to the affected organization. Supplemental metrics add context that does not directly change the base severity calculation.
FIRST recommends publishing both the score and the scoring vector so another analyst can see how the value was derived. A filter that displays only “7.4” loses the version, metric choices and authority behind that number. Two sources can legitimately produce different assessments when they use different metric groups or update their analysis at different times.
Rank #2
- BOLD CYBERSECURITY DESIGN: Features the phrase 'Vulnerability Scanner by Day Ninja by Night' surrounded by striking alert icons and exclamation marks.
- HIGH-QUALITY GLOSSY PRINT: Printed on durable glossy photo paper with vibrant reds and blacks, delivering fade-resistant colors and sharp, lasting details.
- GENEROUS 13x19 SIZE: This large rectangular poster makes a strong visual statement and is easily readable from across any room.
- VERSATILE DECOR FIT: Complements modern decor styles and suits a variety of spaces including home offices, bedrooms, kitchens, and family rooms.
- PERFECT GIFT FOR CYBERSECURITY ENTHUSIASTS: An ideal choice for IT professionals, security analysts, or anyone who values vigilance and dedication in the cybersecurity field.
Use a CVSS Base score as a severity signal, then combine it with exposure, asset importance, compensating controls, exploit intelligence and operational context. A high Base score on software isolated from the network may receive a different remediation priority from a lower score on an internet-facing identity system. The filter should make that distinction visible instead of implying that a number alone is an organizational risk rating.
Make threshold boundaries explicit
Every threshold needs an operator and a rule for values exactly on the boundary. “At least 7” normally means >= 7; “above 7” means > 7. A policy that says “under 4” must state whether 4.0 is excluded. Decimal rounding also matters: filtering on a displayed one-decimal value can differ from filtering on the stored precision.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A documented policy example
Sonatype documents these non-overlapping bands for its own policy:
| Sonatype policy label | Numeric interval | Boundary treatment |
|---|---|---|
| Security-Critical | >= 9 |
Includes 9.0 and 10.0 |
| Security-High | >= 7 and < 9 |
Includes 7.0; excludes 9.0 |
| Security-Medium | >= 4 and < 7 |
Includes 4.0; excludes 7.0 |
| Security-Low | >= 0 and < 4 |
Includes a scored 0; excludes 4.0 |
These are Sonatype’s documented bands, not mandatory CVSS categories. Their use of >= 0 demonstrates why a lower bound can include a legitimate score of zero while still excluding null values. A database comparison such as score >= 0 generally does not match null, but the interface should state that behavior rather than relying on users to infer it.
Declare what score the filter consumes
- Version: identify whether the comparison uses CVSS v3.1, v4.0 or another supported version.
- Metric group: say whether the value is Base, Threat-informed, Environmental or a vendor-derived contextual score.
- Provenance: show the scoring authority, publication or update time, and vector where available.
- Unknown handling: define whether null and missing values are excluded, shown in a separate bucket, or rejected with a warning.
- Rounding: specify whether comparisons use the stored numeric value or a rounded display value.
Separate the result from assessment coverage
A useful vulnerability report has at least two independent outputs:
- Finding result: the count and list of records matching the selected query and threshold.
- Assessment state: what was discovered, what was in scope, which checks completed, which products could not be identified or supported, when data was collected, and which checks failed or were skipped.
The coverage state should be visible even when the finding count is zero. Prefer wording such as “No findings matched CVSS-B >= 7.0. Assessment coverage: partial; unsupported products and unassessed hosts are listed.” If the system cannot quantify omissions, say “coverage unknown” and identify the known limitations. Do not turn an empty result into a claim that every relevant asset was clean.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallDiscovery and product identity affect what can be found
Asset inventory is a prerequisite for vulnerability matching. A device that was never discovered cannot produce a finding. Software identification is another boundary: a scanner may know that a package exists but fail to map it to a supported product identifier such as a CPE. Microsoft Defender documentation illustrates this product-specific limitation: software without a CPE can appear in inventory while lacking vulnerability-management information, and removing the CPE filter can reveal more inventory items. That behavior should not be assumed for every scanner, but it shows why inventory count and vulnerability coverage are different measures.
Freshness and skipped checks matter
Microsoft states that its software inventory data is updated every three to four hours. That cadence is specific to the product and may change. A report should show its own collection timestamp and indicate delayed, failed or skipped checks. “No matches” from a current, complete run is materially different from “no matches” after a failed connector or an outdated inventory refresh.
Use a data model that cannot coerce missing scores to zero
Represent each score as a typed value rather than as a nullable number that downstream code silently converts. Conceptually:
score: scored(value, version, vector, source) | unscored(reason)Store the finding result and coverage object separately. A coverage object can contain discovered assets, in-scope assets, completed checks, unsupported or unmatched software, failed checks and the data timestamp. The query response should preserve the difference between:
- 0 matches: the filter ran and returned no matching findings.
- Assessment incomplete: one or more coverage conditions prevent a complete conclusion.
- Assessment complete with no matching findings: the declared scope was assessed and the threshold matched nothing.
Do not infer “complete” merely because the query executed without an error. Completion is an assessment property, not a database property.
Design the interface so users can read the distinction
Put the threshold, operator, score provenance and coverage status next to the result count. A practical report layout includes:
- Filter: “CVSS-B >= 7.0, CVSS v4.0.”
- Result: “0 findings matched.”
- Coverage: complete, partial or unknown, with counts and omissions where measured.
- Unscored: a separate count or tab for records with no assigned score.
- Timestamp: when inventory and vulnerability data were last refreshed.
Use a distinct badge for “No findings matched” and another for “No assessment data.” The first is an empty set; the second is an absence of evidence. If a user changes the threshold, retain the coverage badge so a series of zero results cannot be mistaken for repeated proof of universal absence.
Compare vulnerability filters on more than their labels
| Comparison axis | Questions to ask |
|---|---|
| Boundary semantics | Are cutoffs inclusive or exclusive, and what happens exactly at 4, 7 or 9? |
| Unknown values | Are null, missing and rejected scores excluded, separately labeled or silently converted? |
| Score provenance | Which CVSS version, metric group, vector and scoring authority are used? |
| Coverage visibility | Does the report show discovery, CPE or product mapping, unsupported software, skipped checks and freshness? |
| Result wording | Does “none” mean no matches to this filter, no findings in a completed assessment, or no assessment data? |
A policy comparison that lists only severity labels misses the decisions that determine whether two systems produce comparable results. Ask for the underlying operator, unknown-value rule and coverage evidence before treating their counts as equivalent.
Recommended Free Tools
A practical workflow for analysts
- Define scope first. Record the assets, accounts, networks, software classes and time window the assessment is intended to cover.
- Confirm discovery. Check that expected assets are present and note any inventory sources that failed or were delayed.
- Check identification support. Review unmatched products, missing CPEs or package identities, and unsupported software categories.
- Select the score deliberately. Choose the CVSS version and metric group, and record the source and vector policy.
- Write the operator. Use an explicit expression such as
>= 7.0or< 4.0, including rounding rules. - Run and report both outputs. Publish the matching count/list alongside coverage state, omissions, failed checks and data timestamp.
- Handle unscored records separately. Route null or missing scores for enrichment or review; never place them in the zero-score bucket.
- Prioritize with context. Combine severity with threat, environmental and business information before assigning remediation urgency.
Common failure modes and corrections
Failure: treating null as 0
Correction: preserve an explicit unscored state and expose it in the UI. A missing assessment is a data-quality or coverage question, not a low-severity result.
Failure: declaring the environment clean after zero rows
Correction: show scope, discovery and check-completion evidence. If any part is incomplete, label the result partial or unknown.
Failure: hiding the boundary rule
Correction: display the operator and test exact cutoff values. Document whether 7.0 belongs to High, Medium or both; overlapping bands create inconsistent totals.
Failure: mixing score versions or sources
Correction: keep version, vector and authority with every score. NVD’s documentation notes that records are enriched from references and information available at enrichment time, and that supported score versions and assessments can differ. Do not compare values as if they came from one immutable scale.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Failure: presenting CVSS Base as organizational risk
Correction: use Base severity as an input, then apply threat intelligence, environmental context, exposure and asset criticality. The resulting priority is a policy decision, not a direct reading of the Base number.
The operational rule
Every CVE/CVSS filter should answer two questions independently: “How many records matched this exact threshold?” and “How complete was the assessment that produced those records?” A scored zero belongs to the numeric domain, null belongs to the unscored domain, and zero findings belongs to the query-result domain. Keeping those domains separate prevents a reassuring-looking empty list from concealing the limits of what was actually examined.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
