T0Offensive Security Fundamentals
Risk, impact and CVSS
How to turn 'this is broken' into 'this matters, this much': the difference between a vulnerability and a risk, and how CVSS, likelihood and business context combine into a severity that means something.
Foundational4 min readfoundation streamUpdated Sat Aug 01 2026 00:00:00 GMT+0000 (Coordinated Universal Time)
Learning objectives
- Distinguish a vulnerability, a threat, and a risk.
- Explain what each CVSS metric group contributes and why Base scores alone mislead.
- Combine likelihood and impact into a severity a non-specialist can act on.
- Write a concrete impact statement and know why AI must not invent CVSS scores.
Academy subscription
Subscribe to unlock this module
This module is part of the StrikeOps Academy subscription. Unlock every paid module, with hands-on labs and knowledge checks.
- Every paid module across all tracks
- Hands-on labs and knowledge checks
- New content as it ships
$59/ month · or $590 / year
The Reference library and Foundation starters are free to read now.