Home / Knowledge hub / Business impact
Knowledge hub
Business impact
What a flaw would cost in money, customers, uptime or trust if used.
What it means
Business impact is what would happen to your company if a flaw were used: money lost, customers affected, time offline, fines, contracts at risk, or damage to trust. It is the cost side of a security finding, written in the terms the business already uses.
Technical severity describes the flaw. Business impact describes what it touches. The same bug can be trivial in a test tool and serious in the system that holds payments, because the difference is what sits behind it. Writing it down in business terms is what lets non-specialists make the decision.
Why it matters
Teams cannot fix everything at once. Without impact, they work from scores alone, and may spend a week on a high-scoring flaw in an unused service while a moderate one in the billing path waits. Impact helps decide what goes first.
It also lets security talk to people who approve budgets. A statement such as a customer could read another customer's invoices is understood by a director in a way that a score is not. It feeds the risk register and informs risk acceptance.
How it shows up
To judge impact, ask what data, money or function the flaw reaches, how many customers or records are in range, what the law or contracts say about that data, and how long recovery would take. Methods such as the OWASP Risk Rating split likelihood from impact for this reason.
Mistakes are to guess a figure with false precision, to ignore the less measurable harms such as trust, and to rate impact once and never update it. Ask the service owner, who knows what the system does. See risk-based prioritisation.
Questions people ask
Business impact, answered
Is business impact the same as severity?
No. Severity describes how serious the flaw is in itself. Business impact describes what it would cost you, given what the system holds and does.
A good priority decision uses both.
How do I estimate business impact without exact numbers?
Use bands such as low, medium and high, tied to plain things: type of data, number of customers, hours offline, contract or legal exposure.
Agree the bands in advance so ratings stay consistent.
Who should decide the impact of a finding?
The owner of the affected system or business area, with security advising. They know what the system supports.
Security alone usually lacks that context. Ask them early, before the report is final.
Does impact change over time?
Yes. A system gains customers, holds more data or becomes critical to a contract. The same flaw then costs more.
Review impact ratings when the system changes, not only at audit time.
How does OWASP rate impact?
The OWASP Risk Rating Methodology scores technical impact, such as loss of confidentiality or integrity, and business impact, such as financial and reputation damage, then combines them with likelihood.
You can adapt the factors to your company.
Sources
Where this comes from
Related
Terms that sit next to this one
Risk rating
A combined view of how likely a flaw is to be used and how much harm it would do.
Severity
How bad a finding is, from critical down to informational.
Risk-based prioritisation
Ordering fixes by real-world risk, not just by the raw severity score.
Exploitability
How easily and reliably a flaw can be used in practice.
Risk register
A running list of risks, their owners, ratings and chosen responses.
What would this one cost you?
Cyberlop keeps severity and confidence apart and shows exactly what each finding reached, so you can judge business impact from evidence. Each finding carries the request and response. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.