Two threats both average 6 in DREAD, one of them scoring Damage 1 and Affected users 10 - why is that ranking untrustworthy?

## The scenario A print-shop order portal has two threats on the board after a modeling session. | Dimension | Threat A | Threat B | | --- | --- | --- | | Damage potential | 1 | 6 | | Reproducibility | 9 | 6 | | Exploitability | 8 | 6 | | Affected users | 10 | 6 | | Discoverability | 2 | 6 | | **Mean** | **6.0** | **6.0** | Threat A is a defect that lets any signed-in customer see the *titles* of other customers' print jobs in a shared queue view: almost no damage per record, works every time, and it touches the entire customer base. Threat B is moderate on every axis. DREAD says they are the same. Nobody who read the two sentences would say they are the same, and that gap is the whole lesson. ## Defect one: the arithmetic flattens the shape The mean has three problems here. **It weights every dimension equally.** DREAD asserts, by construction, that Discoverability matters exactly as much as Damage. No organisation actually believes that. A threat that destroys money or audit truth is not equal to one that is merely easy to find, yet a 1 in Damage is fully cancelled by a 10 elsewhere. **It dilutes extremes.** Risk work usually cares most about the tails - the one dimension that is off the scale is often the reason the threat matters. Averaging is exactly the operation that hides a tail. This is why teams that keep the five prompts frequently sort on the *maximum* or on Damage alone, and use the rest as context. **It performs interval arithmetic on ordinal judgments.** The ratings are ranks: a 10 is worse than a 5, but nothing establishes that the gap from 4 to 5 equals the gap from 9 to 10, or that Damage 8 and Exploitability 8 denote comparable amounts of anything. Averaging assumes both. The output has a decimal point and looks like a measurement, which is the dangerous part: false precision travels well into tickets and slide decks, and by the time it reaches a stakeholder the estimate has become a fact. **It mixes two axes.** Damage and Affected users are impact; Reproducibility, Exploitability and Discoverability are about how likely and how easy the attack is. Collapsing both into one digit means a 6 could mean "catastrophic but very hard" or "trivial but certain", and those two demand completely different responses - the first may be accepted, the second must be fixed this week. ## Defect two: the digits do not reproduce This is the failure that ended DREAD's mainstream use, and it is worth stating carefully because the word collides with one of the dimensions. DREAD's **R** is about whether the *attack* repeats reliably. The problem here is whether the *scores* repeat: hand the same threat to two engineers, or to the same team six months later, and you get different numbers. A managed-service provider team that re-scored one threat against the same design half a year on produced a different D-R-E-A-D vector from an unchanged set of facts. Nothing about the system had changed. What changed was who was in the room, what incident they had just lived through, and whether the person holding the pen felt like an 8 or a 6 that morning. Because no published per-value criteria exist - there is no document that says what Exploitability 7 means as opposed to 6 - the digits encode the raters, not the threat. The consequence is that DREAD scores are not comparable across teams, across time, or even across a long session as the group calibrates mid-flight. Sorting a backlog by a number with that property gives you the *feeling* of prioritisation with none of the substance, and it does not survive being challenged: when an engineer asks why their fix is ranked below another, "the average was 6.4" is not an answer anyone can inspect. ## What to do instead in the room - **Do not collapse the vector.** Keep the five ratings visible next to the threat. Most of the value is in the shape - a 10 in Affected users with a 1 in Damage tells a story the mean deletes. - **Sort on what you actually fund by.** For most teams that is damage and blast radius, with ease of attack as a tiebreaker, not an equal fifth of the answer. - **Write per-value criteria if you keep numbers.** If your organisation needs numbers to travel, define in writing what each rating means for *your* assets and services. That fixes the reproducibility problem, at the cost of admitting you have built your own scheme rather than adopted a standard one. - **Record the sentence, not just the digit.** "Every customer can see every other customer's job titles; the content stays private" survives a re-read six months later. A 6.0 does not. - **Ask what decision the number is for.** If it only decides sprint order among a handful of threats, a short ranked discussion is faster and more honest than five estimates and a division.