How do you set a modeled threat's impact rating without inflating every finding to critical?

## Worst credible, not worst conceivable Every impact discussion drifts upward, because you can always append "and then the attacker could...". Left unchecked, every threat in the model reaches critical, the ratings stop distinguishing anything, and the fix order silently reverts to whoever argues hardest. The discipline that stops the drift is to rate the **worst credible** loss — the worst outcome that follows from this threat, from this attacker position, with no further assumptions — rather than the worst outcome you can construct with enough narrative. ## Assume success; likelihood carries the probability Impact is conditional. Rate it as if the attack happened, every time. "But they would need to be on the internal network" is a true and important statement that belongs entirely on the likelihood axis; repeating it as a reason to lower impact double-counts the difficulty and hides how bad the failure would be. Keeping the axes clean is what makes the shape of a risk visible later — you need to be able to see "unlikely but ruinous" as a distinct thing from "likely and annoying". ## Bound it by what the attacker position reaches Ask what set of data or functions this threat exposes, and stop at the edge of that set. - **Which asset**: personal data, money, availability of a function, credentials, source-code or model IP, the truth of the audit record. - **Which dimension**: is it disclosure, corruption, destruction, denial, or loss of traceability? A read-only enumeration flaw has no integrity or availability dimension at all, and saying so is part of the rating. - **How much**: one record, one tenant, or the whole platform. With sequential identifiers the honest answer is the whole reachable range, not the single record in the report — assuming the attacker stops at one is the mirror-image error to catastrophising. - **How reversible**: money can sometimes be recovered, a service can be restarted, disclosure cannot be undone. Irreversibility legitimately pushes a rating up. ## Translate to business and regulatory harm — with the owner of that harm A technical statement like "confidentiality loss" does not decide anything. Someone has to say what it costs: contractual exposure with the clinics reselling the service, reputational damage in a market that runs on trust, the operational cost of notifying affected people, and whatever duties attach to personal data in the jurisdictions involved. That translation is not an engineer's call to make alone. In the veterinary reminder case, the fields look harmless — a name, a phone number, a pet and a time — but personal-data harm is not measured by field count. The volume, the direct identifiability and the linkage matter: an appointment time is a statement about when someone is out of the house, and the whole set is a ready-made list for targeted social engineering. ## Where to stop the chain The hard boundary is downstream consequences. "The phone numbers enable a phishing campaign, the campaign harvests banking credentials, therefore this is critical" folds three threats into one rating. Each of those steps has its own likelihood and its own controls, and each deserves its own row in the model if it matters. Rating one threat with the accumulated consequences of a chain both overstates it and makes it impossible to see which fix actually helps. ## Controls: usually likelihood, sometimes impact A control that makes an attack harder to reach moves likelihood. A control that limits what a successful attack gets moves impact — per-tenant partitioning so one caller cannot walk across clinics, short-lived unguessable identifiers so the reachable window is minutes rather than the whole history, or a value cap on a transaction. Being able to say which of the two a proposed mitigation buys you is a large part of what an interviewer is listening for, because it determines whether the fix changes the rating at all. ## Say the rating with its reasoning attached "High impact: confidentiality loss of directly identifying personal data for every client of every clinic on the platform, unrecoverable once disclosed, with notification and contractual exposure; no integrity, availability or credential impact." That sentence names the asset, the dimension, the volume, the reversibility, the business harm, and — just as usefully — what is *not* affected. A rating without those clauses is a number someone else has to take on faith, and it is the first thing challenged when the fix competes for a sprint.