Organizations need to move away from vendor-assigned, theoretical scores toward real exploit data specific to their environments.