How is Vulnerability severity determined? Is this based solely on CVSS score or are you combining that with other intelligence to determine what is critical or not?