Overview
Validated findings must be prioritized by severity so the owner fixes the most dangerous issues first. This lesson covers assessing severity in a vulnerability assessment.
Learning objectives
- Explain how severity is determined.
- Describe impact and likelihood in rating.
- Use severity to prioritize remediation.
Core concept
Severity rates the risk of a finding, generally combining impact (consequences if exploited) and likelihood/exploitability (how easily it can be exploited), adjusted for context (affected data, exposure). Findings are rated on a scale (e.g. Critical/High/Medium/Low/Informational), and structured systems like CVSS provide consistent scoring. Severity lets the owner prioritize limited remediation resources on the highest-risk findings, turning a flat list into an actionable, ranked plan.
How it works
For each validated finding, the tester weighs how bad the outcome would be (e.g. full system compromise or mass data exposure = high impact) against how easily it can be exploited (e.g. unauthenticated, internet-facing, trivial = high likelihood), and adjusts for context (sensitivity/exposure of the affected asset). A Critical finding is typically high-impact and easily exploitable; a Low finding is minor and/or hard to exploit. CVSS offers a standardized way to compute this. Clear, justified severity ratings guide the owner's remediation order and communicate risk effectively.
Practical example
A vulnerability assessment yields, among others, a remotely exploitable flaw allowing system compromise (rated Critical — high impact, easily exploited) and a minor information disclosure of low sensitivity (rated Low). The owner, seeing the ratings, remediates the Critical finding immediately and schedules the Low one later. Severity converted the findings into a prioritized action plan focused on real risk, rather than treating every issue as equally urgent.
Cybersecurity relevance
Severity rating enables risk-based remediation — essential because organizations cannot fix everything at once and must address the greatest risks first. Consistent, justified severity (impact × likelihood, optionally via CVSS, context-adjusted) makes findings comparable and actionable, and it reflects the risk-management concepts from the fundamentals path applied to concrete vulnerabilities. It also drives clear communication in the report. Accurate severity depends on validated findings (real impact) and is a core deliverable of the assessment.
Common mistakes
- Rating on impact or likelihood alone, not both.
- Treating all findings as equally urgent, obscuring the critical ones.
- Ignoring context (asset sensitivity, exposure) that changes real risk.
Key takeaways
- Severity rates risk as a function of impact and likelihood/exploitability, context-adjusted, on a Critical→Informational scale (CVSS provides structured scoring).
- It enables risk-based prioritization so owners fix the highest-risk findings first.
- Accurate severity requires validated findings and reflects risk-management principles; it drives remediation order and report communication.
Check your understanding
- What two main factors combine to determine a finding's severity?
- Why is risk-based prioritization by severity important for remediation?