Most penetration test reports rate each finding as critical, high, medium or low, usually based on the Common Vulnerability Scoring System (CVSS). Understanding where those ratings come from helps you fix the right things first.

What CVSS measures

CVSS scores a vulnerability from 0 to 10 using a set of factors, including:

  • Attack vector: can it be exploited over the internet, or does the attacker need local or physical access?
  • Complexity: does it work reliably, or only under unusual conditions?
  • Privileges and user interaction: does the attacker need an account? Does a victim have to click something?
  • Impact: what happens to confidentiality, integrity and availability if it's exploited?

The score maps to a rating: 9.0–10.0 critical, 7.0–8.9 high, 4.0–6.9 medium, 0.1–3.9 low.

Why context changes everything

A base CVSS score describes the vulnerability in general, not your business. The same flaw can matter very differently depending on where it sits:

  • An access-control bug exposing public blog drafts is a nuisance. The same bug exposing customer invoices is critical.
  • A vulnerability on an internal admin tool behind a VPN is less urgent than the same issue on your public login page.

That's why good reports adjust ratings for your environment and explain the business impact in plain language, not just the number.

How to prioritise

  1. Critical and high, internet-facing: fix immediately. These are what attackers find first.
  2. Anything touching personal or payment data: treat one level higher than its score.
  3. Chains: several mediums that combine into a serious attack path should be fixed together.
  4. Lows and informational: batch them into normal development work.

Watch for: reports full of "medium" findings copied from scanner output, such as missing headers or version banners, with no proof of real impact. Severity should reflect what an attacker can actually do.

Every finding in our reports includes the score, the reasoning, proof that it works and a clear fix. Want to see what that looks like? Book a sample report walkthrough.