There are some formulas for risk-assessing security vulnerabilities, like the DREAD formula (Damage, Reproducibility, Exploitability, Affected users, Discoverability -- rate the vuln in each category on a scale from 1 to 10, then add them all up). Is there any evidence that these work better than just having a security professional look at the vulnerability as a whole and say, "Yeah, on a scale of 1 to 5, I give that a 3"?
Here's why I'm skeptical: The times that a formula is useful is when I'm doing something that is out of my area of expertise, like buying a used car, because I don't know anything about what cars are worth. So I would probably end up using a formula that involved the make and model of the car, the number of miles, and any visible damage.
But in assessing security vulnerabilities, the determination of severity is presumably going to be made by someone who has a good intuition of how bad a vulnerability is. In most cases that I've seen, when two experts independently judged how bad a vulnerability was, they came close to the same answer. And when they didn't agree, they certainly weren't going to resolve the disagreement by looking at the formula -- the person whose assessment was different from the formula, would just say that this is one of those times that the formula doesn't work. So I don't know what is the point of the formula. Formulas are useful when non-experts need to make a decision, but the people making decisions about security vulnerabilities shouldn't be non-experts!
So is there any evidence that the formulas have been useful, compared to the intuitive approach? Pretty open-ended about what counts as "evidence", but I'm thinking for example if a company tried the intuitive approach once, and tried the formula approach once, and found that one worked better than the other.