To map severity between scanners, run both on the same code, line up matching findings, and record how each tool rated them. Build a mapping table from that evidence, then set the new tool's gate thresholds to preserve your intent. Do not assume a "high" in one tool means a "high" in another.
Why ratings differ
Scanners draw severity from different places. Some use the base score from a public database. Some adjust for exploit data, reachability or their own research. Others use their own scale for code findings. The same issue can land in different buckets, and unrated advisories may be treated differently. Our note on CVSS scores and severity explains why a number alone is not a decision.
Steps
- Collect a sample. Take one or two repositories, run both tools and export findings.
- Match findings. Use the advisory ID and package or file as the join key.
- Tabulate. For each matched finding, write the old and new rating.
- Look for patterns. Often one tool rates a class of finding consistently higher.
- Write the mapping. One line per level, with a note on exceptions.
A simple output looks like this.
| Old tool says | New tool usually says | Action |
|---|---|---|
| Critical | Critical or High | Block merge in both |
| High | High or Medium | Check which gate each matches |
| Medium | Medium | Warn only |
| Informational | Low or not reported | Ignore |
Your table will differ. The point is that it is based on your findings.
Fix the gates, not just the labels
The risk is not the label, it is the gate. If your pipeline blocks on "high" and the new tool rates your typical issue "medium", the gate silently loosens. If it rates them higher, builds start failing. Set thresholds from the table, then run the gate in report only mode first, as in evaluating pull request gates.
Consider risk, not only severity
If the new tool offers exploitability or reachability context, decide how it should feed prioritization. See severity only versus risk based prioritization.
Try it yourself
Click through it at your own pace, or open it full screen.
Click through the vulnerability list and compare how severity and other context sit side by side for the same finding.
Quick check
Do I need to map every finding?
No. A sample of a few hundred matched findings, or fewer for a small estate, shows the pattern.
What if the new tool rates many things higher?
Review a sample by hand. It may be finding real issues the old tool missed, or it may be rating conservatively. Adjust gates, not the truth.
Safeguard covers SBOM and dependency scanning, reachability analysis, policies and gates, and compliance evidence automation. You can try a free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
