Overview
The point of demonstrating exploitation is to understand a vulnerability's impact — what it actually allows an attacker to do. Impact is central to severity and remediation priority. This lesson covers assessing impact.
Learning objectives
- Define impact in the exploitation context.
- Describe categories of impact.
- Connect impact to severity and prioritization.
Core concept
Impact is the consequence of exploiting a vulnerability — what an attacker gains or can do. It is often framed against the CIA triad (from the fundamentals path): loss of confidentiality (data exposure), integrity (data/functionality tampering), or availability (disruption), plus outcomes like privilege escalation, account/system takeover, or lateral movement. Assessing impact realistically — based on what the (safe) demonstration actually showed and the affected assets — is essential to judging a finding's true seriousness.
How it works
After safely demonstrating a vulnerability, the tester articulates its impact: what data or functionality is affected, what an attacker could achieve, and how that maps to confidentiality/integrity/availability and to escalation/takeover potential. Impact is judged in context — the sensitivity of the affected data and the criticality of the system amplify or reduce it. Combined with likelihood/preconditions, impact determines severity. Clear impact articulation helps owners understand why a finding matters and prioritize accordingly, and it must be grounded in what was actually shown, not exaggerated.
Practical example
A demonstrated access-control flaw is shown to expose all customers' personal data — a severe confidentiality impact affecting sensitive data across many users. Combined with easy exploitability (minimal preconditions), this yields a Critical severity. A different flaw might only allow altering a non-sensitive display setting — minor integrity impact, low severity. Articulating each impact in terms of CIA and affected assets, grounded in the demonstration, lets the owner prioritize the customer-data exposure far above the cosmetic issue.
Cybersecurity relevance
Impact assessment is core to risk-based prioritization: it is the impact half of severity (with likelihood/preconditions), and it communicates why a finding matters. Grounding impact in a safe demonstration (not speculation) makes findings credible. It connects the exploitation phase to severity rating and remediation priority, and reflects the CIA-triad thinking from the fundamentals path. For defenders, understanding impact guides where to focus protection. Honest, evidence-based impact articulation is a hallmark of professional findings.
Common mistakes
- Exaggerating impact beyond what was actually demonstrated.
- Ignoring context (data sensitivity, system criticality) that shapes real impact.
- Assessing impact without likelihood/preconditions, producing skewed severity.
Key takeaways
- Impact is what exploiting a vulnerability allows — framed via the CIA triad (confidentiality/integrity/availability) plus escalation, takeover, and lateral movement.
- It is judged in context (data sensitivity, system criticality) and, with likelihood/preconditions, determines severity.
- Ground impact in the safe demonstration (not speculation); clear, honest impact articulation drives prioritization and communicates why a finding matters.
Check your understanding
- How does the CIA triad help categorize a vulnerability's impact?
- Why must impact be grounded in what was actually demonstrated rather than speculated?