Raise or Lower the Rating?

About this interactive

Scanners and pen test reports rate findings, often with CVSS, from 0 to 10 and as low, medium, high or critical. The Vulnerability Analysis and Reclassification lesson says that rating may not fit your organization. A rating is a general judgment of probability and impact, often made from an external point of view. Your environment changes both. An isolated or well-protected network, a feature that is switched off, or an asset holding nothing of value can make a flaw less likely to be used or less harmful, so you may lower its rating. A host that faces the internet, holds very valuable data, runs critical operations, sits in an industry that treats the flaw as more serious, or is being attacked with it right now can make it more likely or more harmful, so you may raise it. Your organization's risk tolerance plays a part too. A quick test for each card: does the fact make an attack on this flaw less likely or less harmful here, or more?

What you'll learn

Decide whether a published severity rating should be raised or lowered for the organization, from its context: exposure, how valuable the asset is, how the flaw could be used against it, and its risk tolerance
Recognize that a rating given from an outside, general view may not match the probability and impact in one organization

Aligned to

CompTIA Security+

4.3 Explain various activities associated with vulnerability management.

CompTIA CySA+

2.3 Given a scenario, analyze data to prioritize vulnerabilities.

NIST CSF

ID.RA-05 Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization.

Key terms

Recategorization: The reassessment of a vulnerability's actual impact to an organization, which may result in lowering its priority or severity rating.
Common Vulnerability Scoring System: Common Vulnerability Scoring System is an open industry standard that provides a numerical score from 0 to 10 representing the severity of a vulnerability, enabling organizations to prioritize remediation efforts based on base, temporal, and environmental metrics.
Risk Tolerance: The level of risk an organization is willing to accept before taking action to reduce or eliminate it. Risk tolerance is determined by leadership and reflects the organization's risk appetite, regulatory environment, and available resources.
Vulnerability Assessment: The process of identifying, quantifying, and prioritizing vulnerabilities in a system.

Topics

Vulnerability Management Vulnerability Analysis Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →