In its end-of-the-year Trend and Risks Report for 2008, released today, the X-Force contends that a key reason a number of critical vulnerabilities that caused alarm in the security community were not wildly exploited in 2008 was economics. Hackers focus first and foremost on threats they can monetize.

For this reason, the report states, the Common Vulnerability Scoring System (CVSS) needs to make economic considerations part of its scoring formula, instead of focusing just on the technical aspects of a vulnerability.

"The CVSS provides an essential base that the security industry desperately needs to measure security threats," said Kris Lamb, senior operations manager of X-Force Research and Development for IBM Internet Security Systems, in a statement. “But we also realize that cybercriminals are motivated by money, and we need to fully consider how attackers balance the economic opportunity of a vulnerability against the costs of exploitation.”

Read the rest of this article on eWEEK.com.