CVSS tells you how bad, not whether it can reach you

Teaches CVE/CVSS severity scoring and the reachability nuance that determines real-world prioritization, plus IAST/RASP as related hybrid tools.