Thanks Paul.

I have the following based on ColdCoffee's suggestion.

SELECT SERVERIP, 9 AS BASESCOREVALUE, SUM(CASE WHEN (b.BASESCOREVALUE >= 9 and exploitabiltiy IN('H','F','POC') )

THEN 1 ELSE 0 END) [COUNT]

FROM EXAMPLETABLE A

LEFT JOIN VULNS B ON b.vid = a.vid)

GROUP BY SERVERIP

ORDER BY [COUNT] DESC

Which returns the correct number of distinct SERVERIPs (no duplicated). How easily can I incorporate changes that would accomplish the following:

- Remove any duplicate VID, SERVERIP combinations (they do exists)...this is what my CTE was doing for me.

- Ensure I am only counting vulns from the last SCANCOMPLETE date. A single serverip could have been scanned multiple times during a given period.

Thanks!