Overview
Not all findings are equally important. Severity rating prioritizes them by risk so owners know what to fix first. This lesson covers assessing and communicating severity.
Learning objectives
- Explain how severity is determined.
- Describe the roles of impact and likelihood.
- Use severity to prioritize remediation.
Core concept
Severity expresses the risk a finding poses, generally as a function of impact (how bad the consequences are if exploited) and likelihood/exploitability (how easily it can be exploited). Findings are commonly rated on a scale (e.g. Critical/High/Medium/Low/Informational). Standardized systems like CVSS provide a structured way to score severity, and context (the data and function affected, exposure) adjusts it. Severity lets owners prioritize limited remediation effort on the highest-risk issues first.
How it works
For each finding, the tester weighs impact (e.g. full data exposure or account takeover = high impact) against likelihood (e.g. trivially exploitable, unauthenticated, internet-facing = high likelihood). A critical finding is typically high-impact and easily exploited; a low finding is minor impact and/or hard to exploit. Context matters — the same technical flaw can be more severe on a sensitive, exposed system than on a low-value, isolated one. Communicating severity clearly (with the reasoning) helps owners triage and schedule fixes rationally.
Practical example
An assessment rates a broken-object-authorization flaw exposing all users' financial records as Critical (high impact — mass sensitive-data exposure; high likelihood — trivially exploitable by changing an identifier). A missing Referrer-Policy header might be Low/Informational (minor impact, limited exploitability). The owner, seeing these ratings, fixes the Critical BOLA immediately and schedules the low-severity header improvement later. Severity turned a flat list into a prioritized action plan.
Cybersecurity relevance
Severity rating is essential to risk-based remediation: organizations have finite resources, so fixing the most dangerous issues first maximizes security improvement. Consistent, justified severity (impact × likelihood, optionally via CVSS, adjusted for context) makes assessment output actionable and comparable. It reflects the risk-management concepts from the fundamentals path applied to concrete findings. Testers assign and justify severity; owners use it to prioritize. Clear severity communication is a core part of a professional report.
Common mistakes
- Treating all findings as equally urgent, wasting effort and obscuring the critical ones.
- Rating on impact alone (ignoring likelihood) or vice versa.
- Ignoring context — exposure and data sensitivity change a finding's real risk.
Key takeaways
- Severity expresses risk as a function of impact and likelihood/exploitability, commonly on a Critical→Informational scale (CVSS provides structured scoring).
- Context (data sensitivity, exposure) adjusts severity; the same flaw can differ in risk across systems.
- Severity enables risk-based prioritization so owners fix the highest-risk findings first — core to an actionable assessment.
Check your understanding
- What two main factors determine a finding's severity?
- Why can the same technical vulnerability have different severities on different systems?