Overview
Each finding carries a severity rating that prioritizes it by risk — guiding what the owner fixes first. This lesson covers severity in the report.
Learning objectives
- Explain how severity is determined and communicated.
- Describe consistent severity rating.
- Connect severity to prioritization in the report.
Core concept
Severity rates each finding's risk, combining impact (consequences if exploited) and likelihood/exploitability (how easily it can be exploited), adjusted for context — commonly on a scale (Critical/High/Medium/Low/Informational), often via a structured system like CVSS. In the report, severity lets the owner prioritize remediation: findings are typically ordered and addressed by severity, so the most dangerous issues are fixed first. Consistent, justified severity ratings make the report's priorities clear and credible.
How it works
For each finding, the tester assigns severity by weighing how bad exploitation would be (impact) against how easily it could occur (likelihood/preconditions), adjusted for the affected asset's sensitivity/exposure — using a consistent method (e.g. CVSS or a defined rubric) so ratings are comparable across findings. The report presents findings ordered by severity and communicates each rating with brief justification. This turns the findings list into a prioritized action plan: the owner tackles Critical/High first. Consistency and justification are key — arbitrary or inconsistent severities undermine trust and misdirect remediation effort.
Practical example
In the report, the broken-object-authorization finding is rated Critical (high impact — mass data exposure; high likelihood — trivially exploitable), listed first; a missing security header is rated Low (minor impact, limited exploitability), listed later. The owner, following the severity ordering, remediates the Critical finding immediately and schedules the Low one. Each rating includes brief justification (impact and likelihood), making the prioritization transparent and credible. Severity converted the findings into a clear remediation order.
Cybersecurity relevance
Severity is what makes the report actionable through prioritization — organizations can't fix everything at once, so risk-based ordering ensures the greatest risks are addressed first. Consistent, justified severity (impact × likelihood, context-adjusted, e.g. via CVSS) makes findings comparable and priorities credible, reflecting the risk-management principles from the fundamentals path and the severity lessons in the web-assessment and vulnerability-assessment modules. Clear severity communication directly influences remediation decisions. It is a core element of a professional, useful report.
Common mistakes
- Inconsistent or unjustified severity ratings across findings, undermining trust.
- Rating on impact or likelihood alone, ignoring the other or context.
- Not ordering findings by severity, obscuring priorities.
Key takeaways
- Severity rates each finding's risk (impact × likelihood, context-adjusted), commonly on a Critical→Informational scale (often via CVSS), enabling prioritization.
- The report orders findings by severity with brief justification, turning the list into a prioritized action plan (Critical/High first).
- Consistent, justified severity makes priorities credible and actionable, reflecting risk-management principles; it is core to a useful report.
Check your understanding
- How is a finding's severity determined, and how is it used in the report?
- Why is consistency and justification important when assigning severity across findings?