Home / Knowledge hub / Incident severity levels
Knowledge hub
Incident severity levels
Agreed tiers that decide how fast and how widely an incident is escalated.
What it means
Incident severity levels are a short list of tiers, often numbered from one to four, that classify an incident by its impact. Each tier comes with a rule about who is called, how fast they must respond and how often updates are sent.
There is no universal scale. A common pattern is a top tier for a major outage or confirmed data loss and a bottom tier for minor issues with a workaround. What matters is that your team agrees the definitions before the pressure starts.
Why it matters
Without levels, every incident feels equally urgent, or the loudest voice sets the priority. People are woken for small matters and large ones wait until morning. The result is slow response where it counts and tired staff where it does not.
Levels also drive outside duties. A top-tier event may be the point at which you tell customers, speak to counsel, call your insurer, or begin the clock for a breach notification. Linking those steps to a level makes them automatic.
How it shows up
Write each level in terms people can check: how many customers are affected, whether personal data is involved, whether a payment or sign-in path is down, whether an attacker is still active. Put the first response step and the owner on the same page, usually inside the incident playbook.
Do not confuse this with the severity of a vulnerability, which rates a weakness, not an event. Common mistakes are too many levels, definitions that need judgement, and no rule for raising or lowering a level as facts change. Err towards declaring higher early; it is easier to step down.
Questions people ask
Incident severity levels, answered
How many severity levels should we have?
Three or four is usually enough. More levels create arguments about the boundary between them.
Keep each definition short enough to apply in a minute.
Is incident severity the same as vulnerability severity?
No. Vulnerability severity rates how bad a weakness could be, with scores like CVSS. Incident severity rates the impact of an event that is happening now.
A low-rated vulnerability can be part of a serious incident.
Who sets the level?
The first responder or incident lead sets it using the written definitions, and anyone can ask for it to be raised. It can change as you learn more.
Agree the rule in advance so the discussion does not slow things down.
What should a level trigger?
A named owner, a response time, an update rhythm, who is informed, and whether customers, legal, or leadership are told. Each tier should mean different actions.
If two tiers trigger the same steps, merge them.
Should we align with our customers' definitions?
For large customers, it helps. Contracts often set notice times for serious incidents, so match your top tier to those promises.
Check your contracts when you write the definitions.
Sources
Where this comes from
Related
Terms that sit next to this one
Security incident
An event that actually harms, or threatens to harm, your data or systems.
Incident playbook
A step-by-step guide for handling one type of incident the same way each time.
Incident response plan
A written plan for who does what in the first hours after a security incident.
Severity
How bad a finding is, from critical down to informational.
Incident war room
A single place and channel where responders coordinate during a live incident.
Which flaws would be your top tier?
Severity and confidence are kept apart in our findings, and each carries CWE and OWASP references plus proof, so you can see which flaws would make a serious incident. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.