Severity levels
The five finding severities, how they relate to CVSS 3.1 scores, how to prioritise them, and where they appear in the console, reports and integrations.
On this page
Every finding has one of five severities. The level is always written out; colour is only a secondary cue.
Where a finding has a CVSS 3.1 score or vector, the console shows its base score: the reported score, or one computed from the vector. A finding with neither shows a score estimated from its severity, marked as estimated. The score’s colour follows the standard CVSS 3.1 ranges below.
| Level | CVSS 3.1 base score | Suggested response |
|---|---|---|
| Critical | 9.0 to 10.0 | Act immediately. Assign an owner and fix or mitigate the same day. |
| High | 7.0 to 8.9 | Fix in the current cycle. |
| Medium | 4.0 to 6.9 | Schedule a fix. |
| Low | 0.1 to 3.9 | Fix when convenient, or accept with a reason. |
| Info | 0.0 | Review; no fix needed. |
Where severities are used
- Triage queues in Findings filter and sort by severity.
- Reports group findings by severity.
- Slack findings alerts show each finding’s severity.
- Jira issues that an engineer files for you include the finding’s severity.
Notification settings do not filter by severity, and nothing opens a Jira issue automatically at a chosen severity.
Severity describes impact on the tested system. Review it with your own context before you act.