Risk rating

What it means

A risk rating combines two questions about a flaw: how likely is it to be used, and how much harm would follow if it were. The answer is a label such as low, medium, high or critical, chosen against a written method so that two people reach the same result.

It is not the same as severity. Severity describes the flaw in general, such as how much access it gives. Risk is what that flaw means for your business, given who can reach it, how easy it is to use and what it would expose.

Why it matters

Teams cannot fix everything at once, so a rating decides what gets done first. A well-set rating sends effort to the flaws that can hurt you, and lets you say why the others can wait. A rating copied from a generic score sends effort to wherever the number is highest.

It is also what auditors, insurers and customers read. A report that says 'high' with no reasoning invites questions. One that shows the likelihood and impact behind the label can be checked, defended and compared with the last report, which is what a reviewer or a customer is really asking for.

How it shows up

Common methods include the OWASP Risk Rating Methodology, which scores likelihood from threat agent and vulnerability factors and impact from technical and business factors, and NIST SP 800-30, which describes risk assessment in the same two terms. Both end in a table that turns two levels into one rating.

Inputs matter more than formulas. Is the flaw reachable from the internet? Does it need a login? Is it already being used elsewhere (see exploit maturity)? What data would a successful use expose? Record the answers beside the rating, and tie them to your risk register. Compare with severity so the two stay distinct.