Every finding in a network assessment report gets a severity label — Critical, High, Medium, Low. It’s tempting to treat these as a gut-feel judgment call from whoever wrote the report, but a properly run assessment uses a consistent, defensible scoring model behind those labels: impact multiplied by likelihood. Understanding how this works helps you trust the prioritization, and helps you push back intelligently if something doesn’t match your own read of the business context.
The Two Variables
Impact asks: if this were exploited or failed, how bad would the consequences actually be? This considers things like whether sensitive data would be exposed, whether operations would halt, how many systems or users would be affected, and how hard recovery would be.
Likelihood asks: how probable is this, realistically, given the current configuration and threat landscape? A vulnerability that requires physical access to a locked server room in a monitored facility has different likelihood than one exploitable from any device on the guest Wi-Fi.
Both get scored on a scale (commonly 1-5), and the product of the two — not either number alone — determines the overall severity band.
Why Multiplication, Not Just One Factor
A finding with catastrophic impact but near-zero likelihood (say, a theoretical vulnerability requiring an attacker to already have privileged internal access they have no path to obtaining) shouldn’t top your remediation list ahead of a moderate-impact issue that’s trivially exploitable from the internet right now. Multiplying the two factors — rather than rating on impact or likelihood alone — keeps the prioritization grounded in realistic risk, not worst-case imagination.
A Worked Example
Consider two real findings from a typical assessment:
- Guest Wi-Fi sharing a VLAN with production servers: Impact 5 (direct path to critical infrastructure), Likelihood 3 (requires proximity to the guest network, but no credentials needed) → Critical
- Telnet enabled instead of SSH for device management: Impact 3 (credentials could be intercepted, but requires an attacker already on the internal network), Likelihood 3 (plausible if internal segmentation is already weak) → Medium
Same report, two different severity levels, both derived from the same consistent scoring logic rather than a subjective label.
Why This Matters for How You Budget Remediation
Impact × likelihood scoring gives you a rational basis for sequencing work under real budget constraints. Critical findings (high impact, meaningfully likely) get addressed first, typically within two weeks. High findings follow within 45 days. Medium and low findings get scheduled realistically rather than ignored indefinitely — because “low priority” isn’t the same thing as “not worth fixing,” it just means it can wait for the next maintenance window without meaningfully increasing your risk exposure in the meantime.
What to Ask If a Rating Doesn’t Match Your Gut
If a finding is rated lower than you expected, ask what likelihood assumption was used — sometimes internal context (an unpublicized compensating control, a system slated for decommission) genuinely changes the picture, and a good assessment will adjust the rating once that context is shared during the interview phase.
Our sample network assessment report shows this scoring model applied across a full findings register, including the reasoning behind each rating.