Severity and CVSS rubric
The calibration reference for rating findings: what each severity level means, how to use CVSS without being ruled by it, and how to turn a score into a risk.
On this page
Learning objectives
- Assign a consistent severity level to a finding based on risk, not raw score
- Use the three CVSS metric groups and tailor a score to the client's context
- Write an impact statement that makes the risk legible to a non-specialist
A practical reference for rating findings consistently. This is the lookup you keep open while writing findings: how the levels are defined, how to use CVSS without being ruled by it, and how to turn a score into a risk a client can act on.
The five severity levels
Calibrate to risk (likelihood times impact in this environment), not raw CVSS.
| Severity | Means | Typical examples | Action |
|---|---|---|---|
| Critical | Direct path to major impact; exploit is realistic now | Unauthenticated RCE on a sensitive system; a full domain-compromise chain; mass PII exposure | Fix immediately |
| High | Serious, exploitable, meaningful impact | Privilege escalation; significant access-control failure; credential exposure | Fix soon |
| Medium | Exploitable under conditions, or moderate impact | Issues needing a precondition; info disclosure that enables a chain | Plan remediation |
| Low | Limited impact or hard to exploit | Hardening gaps, minor misconfig, low-value disclosure | Fix opportunistically |
| Info | No direct risk | Observations, defence-in-depth notes, positive validations | Awareness |
The chain rule. Rate a finding for what it enables, not just what it is alone. An audit-log leak looks low, until it hands an attacker the identifier that completes a privilege-escalation chain. Score the role it plays.
Using CVSS (v4.0) well
CVSS gives a defensible, comparable 0 to 10 score. Record both the vector and the score on every finding. Its metric groups:
- Base covers intrinsic properties: attack vector, complexity, privileges required, user interaction, and impact to confidentiality, integrity and availability. A property of the vulnerability.
- Threat asks whether there is a known or weaponised exploit. It raises urgency.
- Environmental covers your client's context: how important is this specific asset? This is where a generic score becomes a real risk, so do not leave it on the table.
Rough score-to-severity banding (a guide, not a law):
| CVSS | Band |
|---|---|
| 9.0 to 10.0 | Critical |
| 7.0 to 8.9 | High |
| 4.0 to 6.9 | Medium |
| 0.1 to 3.9 | Low |
| 0.0 | Info |
CVSS is a yardstick, not an oracle. A 9.8 on an isolated, dataless, decommissioned box may be a low risk; a 6.5 on the one server holding every customer record may be a high risk. Let business impact override the band when they disagree, and say why.
Likelihood times impact (for the matrix)
For communicating to non-specialists, a matrix often beats a decimal. A finding can carry a likelihood alongside severity to render a risk matrix:
| Low impact | Medium impact | High impact | |
|---|---|---|---|
| Likely | Medium | High | Critical |
| Possible | Low | Medium | High |
| Unlikely | Low | Low | Medium |
- Likelihood is feasibility given the attacker model, exposure, and whether an exploit exists.
- Impact is data loss, downtime, financial, reputational and regulatory harm.
Writing the impact statement
Severity is a label; the impact statement is where risk becomes legible. Be specific about who, how feasibly, and what they get:
Weak: "This could be exploited by an attacker." Strong: "An unauthenticated attacker on the internal network could use this to reach Domain Admin within hours, giving full control of every system and all customer data."
Status, for completeness
Findings also carry a status that the report reflects honestly: open, then confirmed, then resolved, accepted (client owns the risk), withdrawn or duplicate. For recurring engagements, retest verdicts add verified_fixed, still_open, regressed and risk_accepted.
Related reading
- Frameworks and standards
- Glossary
Knowledge check
Answer without AI. This is your own recall. 70% to pass.
1.A finding scores CVSS 9.8 but sits on an isolated, dataless, decommissioned box. How should you rate its risk?
2.Which CVSS metric group captures how important this specific asset is to the client?
3.What does the chain rule tell you to rate a finding for?