The Attack Requirements (AT) metric replaces the less granular Attack Complexity - The naming convention changes: "CVSS-B" for base score, "CVSS-BT" for base + threat, "CVSS-BE" for base + environmental, "CVSS-BTE" for all groups - The scoring formula has been updated, meaning some vulnerabilities w