Assurance
5 min
A finding is not a risk
Severity labels describe a vulnerability. They say almost nothing about what it would cost you.
A report arrives with forty findings: six critical, eleven high. The security team works top-down. Six months later the same report arrives with a similar distribution, and nobody can say whether the organisation is safer.
The problem is that severity is a property of a vulnerability in isolation. Risk is a property of a chain: what an attacker can reach from where they start, and what happens to the business when they get there. A medium-severity issue on the path to customer data outranks a critical on a system nobody can route to.
We write findings as paths for this reason. Entry point, pivot, consequence. It changes the conversation from a queue of tickets into a small number of decisions, and it usually reveals that closing one design-level weakness collapses a dozen individual findings at once.
It also survives contact with leadership. A board cannot act on 'eleven high'. It can act on 'an unauthenticated route reaches customer records in three steps, and here is what closing it costs'.