Severity
What Critical actually means, and who decided.
Severity is the part of a report everyone reads and almost nobody defines. Firms publish whole reports and never publish the scale behind them. Here is ours, in full, so you can judge a deliverable before you buy one — and hold us to it afterwards.
Findings are rated on business risk — what the issue costs your organisation if it is used — informed by CVSS v3.1, not dictated by it.
| Rating | What it means | Expected response |
|---|---|---|
| Critical | Immediate, severe business impact and straightforward to exploit. Typically unauthenticated and reliable, leading directly to data loss, financial loss or control of the environment. | Fix now. Escalate the same day; apply interim mitigation if the full fix takes time. |
| High | Significant impact and realistic to exploit, though it may require a position, an account or a precondition. Often the decisive link in a chain. | Fix in the current cycle. Do not let it enter a general backlog. |
| Medium | Moderate impact, or serious impact that depends on conditions outside the attacker’s full control. | Plan remediation with a committed date in the next cycle or two. |
| Low | Limited direct impact. Hardening and defence in depth; useful to an attacker mainly in combination with something else. | Schedule alongside related work. |
| Informational | No direct security impact. An observation, or a deviation from good practice. | Note it. Act at your discretion. |
CVSS
How we use it, and where it stops
For vulnerability findings where CVSS applies, we include a base score and vector alongside our business-risk rating. This supports consistent comparisons. Red-team control findings are assessed in their operational context rather than assigned a CVSS score.
What CVSS deliberately does not know is your business. A base score describes a vulnerability in the abstract: it has no view on whether the affected system holds regulated personal data or a staging copy of last year’s catalogue, whether a compensating control makes the attack impractical, or whether an outage there stops you trading.
So the score is an input and the rating is a judgement. Where the two disagree, the finding states the rating, the score and the reason.
A headline vulnerability with a frightening score
on a system that cannot be reached, holds nothing and is being decommissioned, will be rated Low here — and we will show our working.
A modest-looking issue with an unremarkable score
sitting on the path to your most sensitive data will be rated High, because that is what it is worth to someone attacking you.
What this commits us to
The part that is easy to get wrong
- We do not inflate to justify an invoiceA report padded with informational noise costs you triage time and tells you nothing. If an engagement finds little, the report says so and shows the coverage that supports the claim.
- We do not downgrade to make a result look betterNeither ours nor yours. A finding is rated on what it would cost you if it were used, not on how it reads in a summary.
- Findings we could not reproduce are reported as suchHonestly, rather than dropped or inflated. Something we saw once and cannot reproduce is more useful to you as an open question than as silence.
- A rating is explained wherever it departs from the scoreIf we rate above or below the CVSS base score, the finding states the rating, the score and the reason. You should never have to guess why.
See it applied
Every finding in our sample penetration test report carries its rating, its CVSS score and vector, and the reasoning behind both. The rules of engagement set out how serious findings are escalated before the report is written, and how engagements are shaped covers what a given engagement is trying to prove in the first place.
FAQ
Questions about severity
Do you use CVSS?
Yes. Where CVSS applies, we include a CVSS v3.1 base score and vector alongside our business-risk rating. The base score describes the vulnerability’s technical characteristics; our rating also considers the affected system, its data and the business impact. Red-team control findings are assessed in their operational context rather than assigned a CVSS score.
What if we disagree with a rating?
Tell us. The rating, the score and the reasoning are all in the finding precisely so that it can be argued with. If you know something about the system's context that we do not — a compensating control, a network boundary, a decommissioning date — that may genuinely change the rating, and we will reissue the report rather than leave you to annotate it.
Will our auditor accept these ratings?
We provide the rating, the supporting evidence and reasoning, plus the CVSS score and vector where applicable. Your auditor or assessor decides what evidence is sufficient. We are a testing firm, not an auditor or certification body.
Does a Critical finding mean we have been breached?
No. A severity rating describes what an attacker could do, not what has already happened. If we find evidence that someone else has been in the environment, that is handled completely differently — we stop, preserve what we have seen and notify you immediately. That is set out in our rules of engagement.
Want this applied to your systems?
Tell us what you want to protect. A senior tester will help you agree the scope and next steps. We usually reply within one business day.
Confidential from the first conversation
We can sign your NDA before you share sensitive details. Your enquiry is covered by our privacy policy.
How we protect your information · Privacy policy