The new scoring system promises to make it easier for security managers and the IT industry to better measure the real-world risks associated with software flaws.