Overview
Programs define severity rules that determine how findings are rated and rewarded. Understanding them helps researchers prioritize and set expectations. This lesson covers severity rules.
Learning objectives
- Explain program severity rules and reward tiers.
- Describe how severity is determined.
- Connect severity to prioritization and expectations.
Core concept
Severity rules in a program define how the impact of findings is rated (often Critical/High/Medium/Low, sometimes via CVSS) and how severity maps to rewards. Programs typically publish a severity/reward structure and may specify how they assess impact for their context, plus which issue types they consider higher or lower priority (and which are out-of-scope/accepted risks). Severity combines impact and likelihood/exploitability, adjusted for the asset's importance. Understanding a program's severity rules helps researchers prioritize where to focus and set realistic expectations about rewards.
How it works
A program's policy states its severity scale and reward tiers, and often guidance on how it rates common issue types in its environment. When a researcher finds a vulnerability, its severity (impact × likelihood, per the program's criteria) determines its priority and likely reward. Researchers use this to focus on higher-impact areas (Critical/High findings are more valuable) and to understand how the program will likely assess a given issue. The program makes the final severity determination during triage, sometimes adjusting based on context the researcher may not see. Aligning with the program's severity rules improves report quality and expectation-setting.
Practical example
A program's policy rates a remote, unauthenticated data-exposure flaw as Critical (top reward tier) and a low-impact information disclosure as Low (minimal or no reward), using CVSS-based criteria. A researcher, understanding this, prioritizes hunting for high-impact issues like access-control flaws over low-severity ones, and when submitting, frames the finding's impact per the program's severity criteria. The program confirms the severity during triage. Knowing the severity rules guided the researcher's focus and set accurate reward expectations.
Cybersecurity relevance
Severity rules matter to researchers for prioritization (focusing effort where impact — and reward — is highest) and expectation-setting (understanding how findings will be rated), and they reflect the same impact × likelihood risk model from the fundamentals and assessment paths. Accurately understanding and framing severity per the program's criteria also improves report quality and triage outcomes. For the organization, severity rules communicate priorities and manage the program. Understanding severity is thus both a strategic (where to focus) and a communication (how to frame findings) skill in bug bounty.
Common mistakes
- Ignoring the program's severity/reward structure, misjudging where to focus.
- Over-rating one's own findings, leading to unrealistic reward expectations.
- Not framing impact per the program's criteria, weakening reports.
Key takeaways
- Severity rules define how findings are rated (Critical→Low, often via CVSS) and mapped to rewards, plus which issue types are higher/lower priority or out-of-scope.
- Severity combines impact and likelihood, context-adjusted; the program makes the final call during triage.
- Understanding severity rules helps researchers prioritize high-impact areas and set realistic reward expectations, and improves how findings are framed — reflecting the impact × likelihood risk model.
Check your understanding
- How do a program's severity rules help a researcher decide where to focus?
- What two factors combine to determine a finding's severity, and who makes the final determination?