Free Engineering Workbench calculator
OWASP risk rating
Rate an application security finding by likelihood and impact, the way many testing reports do.
Cybersecurity & cyber assuranceHow it's worked out
- Likelihood = average of 8 factors; impact = average of 4 factors. Levels: under 3 low, 3 to under 6 medium, 6 to 9 high. Severity from the 3 × 3 matrix
- Factor scores 0 to 9 from the OWASP guidance
NoteWhere business impact is known, use it instead of technical impact, as the method recommends.
Source: OWASP Risk Rating Methodology
Need help acting on this number?
VVnT SeQuor's Cybersecurity & Cyber Assurance practice helps teams turn this metric into a plan.