By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
However, critics feel that the extra tier will add even more complexity to an administrator's job.
Under the new system, fewer bulletins will get the "critical" stamp. Only vulnerabilities that could be exploited to allow malicious Internet worms to spread without user action will now be rated critical.
Many issues that were previously rated critical will now be ranked "important", the latest category in the rating system.
These "important" vulnerabilities could still expose user data or threaten system resources, but there are fears that they might not receive the urgent attention from administrators that they deserve.
"If Microsoft wanted to simplify matters, they should've done just that - cut the categories down from three to two levels. Administrators want to know whether a patch needs to be applied immediately, or if they can conveniently schedule it," said Thor Larholm, a Danish-based security researcher with PivX Solutions.
A two-tiered system would let administrators quickly decide whether they needed to drop all tasks at hand and apply a patch, or whether the risk was small enough that they could wait and include it in a weekly patch cycle.