OWASP Risk Rating Calculator rates a security finding with the OWASP Risk Rating Methodology. You score 16 factors from 0 to 9, eight for likelihood and eight for impact, and it combines them into a likelihood level, an impact level and an overall severity from Note to Critical. You can also paste a vector such as SL:6/M:4/O:7/... to reproduce someone else's rating.
How to read the result
Likelihood is the average of four threat-agent factors (skill, motive, opportunity, size) and four vulnerability factors (ease of discovery, ease of exploit, awareness, intrusion detection). Impact is the average of either the four technical factors (loss of confidentiality, integrity, availability, accountability) or the four business factors (financial, reputation, non-compliance, privacy), depending on the basis you choose. Averages under 3 are LOW, under 6 MEDIUM, otherwise HIGH, and the two levels meet in the methodology's severity matrix.
The factors table shows each score with its meaning, and the vector line lets you share the exact rating.
Defender tips
- Use business impact when you know it. The methodology prefers it, and it is what management acts on.
- Agree the scoring of threat-agent factors once per application, so different testers do not rate the same exposure differently.
- Record the vector with the finding. A severity label without its factors cannot be reviewed or challenged later.
FAQ
How is this different from CVSS?
CVSS describes a vulnerability in a standard way across products. The OWASP method rates risk to your own application and business, so it includes who might attack and what a breach would cost you.
Why do two identical findings get different ratings?
Because likelihood and business impact depend on the application's users, data and monitoring, not only on the flaw.
Is anything sent or stored?
Nothing is sent to a server: the rating is calculated in your browser. If you accept optional storage, your last few inputs are kept in this browser for 7 days so you can rerun them.