Rank threats with risk equals likelihood times impact. The OWASP Risk Rating Methodology scores each factor from 0 to 9, averages the scores, and turns the result into Low, Medium or High for both likelihood and impact. A simple matrix then gives the overall severity. The point is a defensible order for fixing things.
The six steps
OWASP describes the method in six steps:
- Identify the risk, including threat agent, attack, vulnerability and business impact. Use the worst case when you have options.
- Estimate likelihood.
- Estimate impact.
- Determine severity.
- Decide what to fix, most severe first, and accept some risks when fixing costs more than the loss.
- Customize the model to fit your organization.
What goes into likelihood
Two groups of factors. Threat agent factors are skill level, motive, opportunity and size of the group. Vulnerability factors are ease of discovery, ease of exploit, awareness and intrusion detection. Score each from the listed options, then average the eight numbers.
What goes into impact
Technical impact covers loss of confidentiality, integrity, availability and accountability. Business impact covers financial damage, reputation damage, non-compliance and privacy violation. OWASP prefers business impact when you have it and falls back to technical impact when you do not.
From numbers to a rating
Scores below 3 are Low, 3 up to 6 are Medium, and 6 to 9 are High. Combine the two ratings using the OWASP matrix:
| Impact and likelihood | Low | Medium | High |
|---|---|---|---|
| High impact | Medium | High | Critical |
| Medium impact | Low | Medium | High |
| Low impact | Note | Low | Medium |
A lighter version for busy teams
Full scoring of eight factors per threat is slow. OWASP also describes an informal method: look over the factors, find the ones that drive the result, and decide. For a one hour session that is often enough. Use the full method for the handful of threats that will cost real money to fix or that you plan to accept.
Tips
- Rate threats as a group, not alone. Disagreement is useful information.
- Write down why you chose each rating in one sentence.
- Re-rate when the system changes, such as when a service becomes internet facing.
- Keep fix effort as a separate column. The cheat sheet notes effort can be considered, but it should not change the risk score.
A worked example
Suppose a threat is an attacker guessing promo codes on a public endpoint. Skill needed is low, motive is moderate, opportunity is high, and the group of possible attackers is large, so likelihood leans High. Technical impact is small, but business impact is moderate because codes cost money. With High likelihood and Medium impact the matrix gives High. A different threat, such as tampering with an internal batch job, might have Low likelihood and High impact, giving Medium. The numbers matter less than the conversation they provoke.
Quick check
Do I have to use the OWASP scale?
No. The methodology itself says to customize it. The important part is using the same scale every time so ratings are comparable.
Can a high severity threat be accepted?
Yes, if the owner documents the reason and the business agrees. Accepted risks should be reviewed on a schedule, not forgotten.
Sources
Last reviewed: 19 October 2026.
