Overview
The report's impact section explains what the finding means for the organization — why it matters. This lesson covers communicating impact in the report.
Learning objectives
- Explain the impact section's role.
- Describe articulating impact clearly and accurately.
- Connect impact to severity and reward.
Core concept
The impact section states what the vulnerability allows and why it matters — framed via the CIA triad and concrete outcomes (data exposure, account takeover, privilege escalation), grounded in the validated, safely-demonstrated impact (from the validation module). It translates the technical finding into business/security risk for the organization. A clear, accurate impact statement justifies the finding's severity and reward, and helps the organization understand why to prioritize the fix. It must be honest — grounded in what was demonstrated, neither exaggerated nor understated.
How it works
The researcher articulates the impact concretely: what an attacker can achieve (e.g. "any user can read all other users' financial records"), which security properties are affected (confidentiality/integrity/availability), and the scope (how many users/assets, data sensitivity). This is grounded in the safe demonstration — not speculation or exaggeration. The impact section connects the technical finding to real risk, which drives severity and reward and motivates the fix. Clear, accurate impact communication is what makes the organization understand the finding's significance. Overstating impact undermines credibility; understating it undersells a valid finding.
Practical example
For the BOLA finding, the impact section might state: "Any authenticated user can read any other user's invoices by changing the id parameter, exposing sensitive financial and personal data for all users. This is a confidentiality breach affecting the entire user base and could enable further fraud." This concretely conveys what the flaw allows, which property it violates, and its scope — grounded in the safe demonstration, justifying a high severity. The clear impact statement showed the organization why the finding matters.
Cybersecurity relevance
The impact section is what conveys a finding's significance and justifies its severity/reward — translating a technical issue into business/security risk the organization understands. Grounding it in the safe, validated demonstration (not exaggeration) maintains credibility and appropriate valuation, echoing the validation impact lesson and the reporting severity/impact principles. Clear impact communication motivates prioritized remediation and appropriate reward. In bug bounty, articulating impact well is directly tied to how a finding is valued and acted on — a key reporting skill.
Common mistakes
- Exaggerating impact beyond the demonstration (undermines credibility).
- Understating or vaguely stating impact, underselling the finding.
- Not grounding impact in the safe, validated demonstration.
Key takeaways
- The impact section states what the vulnerability allows and why it matters (via CIA and concrete outcomes), grounded in the validated, safe demonstration.
- It translates the technical finding into business/security risk, justifying severity and reward and motivating the fix.
- Communicate impact clearly and accurately (neither exaggerated nor understated); it directly affects how the finding is valued and acted on.
Check your understanding
- What should the impact section convey, and how does it relate to severity and reward?
- Why must impact be grounded in the safe demonstration rather than exaggerated?