OWASP risk rating methodology: a step by step walkthrough

The OWASP risk rating methodology scores a finding in six steps: identify the risk, estimate likelihood, estimate impact, combine them into a severity, decide what to fix first, and tailor the model to your organization. Likelihood and impact are each averaged from factors scored 0 to 9, then banded low, medium or high.

The six steps

1. Identify the risk: the threat agent, attack, vulnerability and business impact.
2. Estimate likelihood.
3. Estimate impact, both technical and business.
4. Determine severity by combining the two.
5. Decide what to fix, most severe first.
6. Customize the model for your organization.

Likelihood factors

Eight factors, in two groups, each scored from 0 to 9 on a defined list of options.

• Threat agent: skill level, motive, opportunity, and group size.
• Vulnerability: ease of discovery, ease of exploit, awareness, and intrusion detection.

OWASP says to use the worst case threat agent. For example, ease of exploit scores 1 if theoretical and 9 if automated tools are available.

Impact factors

• Technical impact: loss of confidentiality, integrity, availability and accountability.
• Business impact: financial damage, reputation damage, non-compliance and privacy violation.

OWASP advises using business impact when you have it and technical impact otherwise.

Turning numbers into severity

In the repeatable method you average the likelihood factor scores and the impact factor scores. Each result is banded: 0 to under 3 is low, 3 to under 6 is medium, and 6 to 9 is high. A matrix then combines the two. High impact with high likelihood is critical. Low impact with low likelihood is a note.

An informal alternative is to identify the key driving factors instead of calculating.

Using it well

• Score the real scenario, not the worst imaginable one, except for the threat agent, where OWASP specifies the worst case.
• Have two people score independently and compare. Differences point to unclear assumptions.
• Record the factor scores. The reasoning matters as much as the label.
• Remember the output is a ranking aid. A medium with a trivial fix may deserve doing today.

Limits

Averaging factors treats a strong score on one factor as able to offset a weak one. A single factor that makes exploitation trivial, such as a public exploit and no authentication, may deserve extra weight. That is where step six helps: adjust the factors and weights to fit your environment, and document the change.

For findings with a known CVE, combine this approach with exploitability evidence from your own environment, not only a generic severity number.

A short worked pass

Take a stored cross site scripting flaw in a customer portal. A skilled attacker is not required, so skill level might score low to mid. Motive is possible, opportunity is any authenticated user, and group size is authenticated users. Ease of discovery and exploit are easy, awareness is hidden or obvious depending on whether it was published, and logging may exist but go unreviewed.

You average those eight numbers to get overall likelihood, then do the same for impact using business factors such as privacy violation and reputation damage. Band both, look up the cell, and you have a severity you can defend factor by factor.

Quick check

Sources

• OWASP Risk Rating Methodology

Last reviewed: 19 October 2026.