Home / Knowledge hub / Severity vs confidence
Knowledge hub
Severity vs confidence
How bad a finding is, kept apart from how sure the tester is that it is real.
What it means
Severity and confidence answer two different questions about a finding. Severity asks how bad it would be if the flaw is real. Confidence asks how sure the tester is that the flaw is real at all. A rating that blends them tells you neither.
A finding can be high severity and low confidence: a pattern that would be disastrous if true, but not yet shown. It can also be low severity and high confidence: a flaw proven to work, with small consequences. CVSS measures severity only, and FIRST says it should not be read as a measure of risk.
Why it matters
If the two are merged, one of two failures follows. Uncertain findings are rated high and swamp the queue with alarms nobody can confirm, or they are rated low and a real critical flaw is overlooked. Separate ratings let you act on what is certain and investigate what is not.
Customers and auditors also gain. They can see how much of a report is proven. A report of ten high-severity findings, all confirmed, differs from one where nine are unconfirmed. It is the difference between an exploited finding and a suspected one.
How it shows up
Look for both fields on every finding. Severity might be critical, high, medium, low or informational, often backed by a CVSS vector. Confidence might be confirmed, probable or possible, with a note on what evidence exists. Some tools show only a single score and hide the doubt.
In practice, work the confirmed items first and set aside a time to resolve the uncertain ones: either gather the proof or close them. Do not raise severity to get attention, or lower it to avoid a fight. Change confidence when evidence changes, and record why. See also false positives.
Questions people ask
Severity vs confidence, answered
What is the difference between severity and confidence?
Severity is the potential harm if the finding is real. Confidence is how certain the tester is that it is real.
They are independent and both belong on the finding.
Is confidence the same as likelihood?
No. Likelihood is the chance a flaw will be exploited. Confidence is the tester's certainty that the flaw exists.
One concerns attackers and the other concerns evidence. A flaw can be very likely to be exploited and still unproven in your system.
How is confidence usually shown?
As levels such as confirmed, probable or possible, with a note on the evidence behind it.
A confirmed finding has been exploited and shown. Lower levels need more work. Whatever scale you choose, define each level in writing so readers use it the same way.
Should low-confidence findings be reported?
They can be, if clearly labelled, so the team can decide whether to investigate. Hiding them loses information.
Presenting them as confirmed is the mistake. Showing the confidence is what keeps the report honest.
Does CVSS include confidence?
Not as such. The temporal metric report confidence in version 3.1 relates to the credibility of a vulnerability report, but the base score is about severity.
Keep your own confidence field next to it.
Sources
Where this comes from
Related
Terms that sit next to this one
Severity
How bad a finding is, from critical down to informational.
False positive
A reported issue that turns out not to be real.
Exploited finding
A finding confirmed by actually using it, not one that only looks likely.
Risk rating
A combined view of how likely a flaw is to be used and how much harm it would do.
Security finding
One confirmed weakness in a report, with the evidence to show it is real.
How bad, and how sure?
Severity and confidence are kept apart on every finding we report, with CWE and OWASP references and proof of what was exploited. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.