How does OWASP Risk Rating break likelihood and impact into factors you can grade?

## Why a factor list at all The useful thing about OWASP Risk Rating is not the arithmetic, it is that it forces disagreement to become specific. Two people arguing about whether a threat is "high" get nowhere; two people arguing about whether *opportunity* is a 4 or a 9 are arguing about a checkable fact — what access the attacker must already have. The factors are a shared vocabulary for a conversation that otherwise runs on instinct. ## The four groups | Axis | Group | Factors | | --- | --- | --- | | Likelihood | Threat agent | skill level, motive, opportunity, size | | Likelihood | Vulnerability | ease of discovery, ease of exploit, awareness, intrusion detection | | Impact | Technical | loss of confidentiality, loss of integrity, loss of availability, loss of accountability | | Impact | Business | financial damage, reputation damage, non-compliance, privacy violation | Each factor is given a score from 0 to 9 using the option lists the method supplies, the scores in a group are averaged, and the average is read as **low** below 3, **medium** from 3 up to 6, and **high** from 6 to 9. Likelihood and impact are then read together to produce an overall severity for the threat. ## Grading a worked threat Take a freight-broker load-tender portal. The threat: a competing broker with a legitimate carrier account can enumerate tender records and read the prices and customer names another broker offered. Asset at stake is pricing and customer-list trade secrets. - *Skill level*: modest — an authenticated user changing an identifier, not an exploit developer. - *Motive*: high — the reward is directly commercial and repeatable every day. - *Opportunity*: high — the attacker already holds a valid account, so no special access is needed. - *Size*: low — the realistic attacker set is a handful of competing brokers, not the internet. - *Ease of discovery* and *ease of exploit*: high — sequential identifiers surface by accident. - *Awareness*: middling — the flaw is not published, but a competitor who finds it will not report it. - *Intrusion detection*: poor if tender reads are logged but nobody reviews them. On impact, the technical loss is confidentiality only — no integrity or availability effect. The business factors are where this threat is actually decided: financial damage from systematically undercut bids, reputation damage with shippers whose commercial terms leaked, and possibly contractual or non-compliance exposure. Note how business impact outranks the technical picture; a purely technical read would call "one field disclosed" minor. ## Two directions people get backwards **Intrusion detection is scored inversely.** A system with active detection and response scores at the low end of the range; one that logs without review scores mid-range; one that logs nothing scores at the top. A high score means the attacker is unlikely to be caught, which raises likelihood. Candidates frequently assume "good logging, so a high detection score", which reverses the whole factor. **Detection is a likelihood input, not an impact input.** It changes whether the attack proceeds and repeats, not what is lost when it succeeds. What logging protects on the impact side is a different factor entirely — loss of accountability, meaning whether actions can be traced to an individual. ## Business impact over technical impact The method is explicit that business impact is what matters and technical impact is a stand-in for it. Engineers reach for the technical group because they can fill it in alone; the business group needs a product owner, a commercial lead or legal to tell you what a leaked customer list or a missed regulatory duty actually costs. Doing that legwork is the difference between a rating an engineer believes and a rating that gets funded. ## Use it as a guide, not a measurement The method itself says the factors can be dropped, added or weighted for your context — a threat with no personal data has nothing to say about privacy violation, and forcing a number there just dilutes the average. Treat the resulting figure as a way to keep ratings comparable and the discussion anchored, not as a precise quantity. When you present the rating, present the two or three factors that drove it; the average alone tells the reader nothing about *why* the threat scored where it did, which is the only part that helps them decide what to do.