Risk Scoring
CVSS and prioritization.
Risk Scoring is a free Cyber Security Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Why Score Risk
A list of vulnerabilities is not enough. The client needs to know which ones to fix first.
Risk scoring turns subjective opinions into a consistent, defensible ranking that everyone can agree on.
Introducing CVSS
The Common Vulnerability Scoring System (CVSS) is the industry standard for rating vulnerability severity on a 0 to 10 scale.
It is maintained by FIRST and used in the National Vulnerability Database. CVSS v3.1 and v4.0 are the current versions.
The Severity Bands
CVSS scores map to named severity bands. These names drive how the report is read.
Use the same bands everywhere in your report.
0.0 None
0.1 - 3.9 Low
4.0 - 6.9 Medium
7.0 - 8.9 High
9.0 - 10.0 CriticalBase Metrics
The CVSS base score describes the intrinsic qualities of a vulnerability that do not change over time.
It is split into exploitability and impact metrics.
- Attack Vector, Attack Complexity, Privileges Required, User Interaction.
- Confidentiality, Integrity, Availability impact.
Reading a Vector String
CVSS scores travel as a compact vector string. Learning to read it lets you justify any score.
Each pair is a metric and its value.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:N = Attack Vector: Network
AC:L = Attack Complexity: Low
PR:N = Privileges Required: None
C:H = Confidentiality impact: HighTemporal and Environmental
Beyond the base score, CVSS offers temporal metrics (is there a public exploit?) and environmental metrics (how important is this asset to this client?).
Environmental scoring lets you raise or lower a base score for the client context.
CVSS Is Not the Whole Story
A high CVSS base score does not always mean high business risk. A critical bug on an isolated test box matters less than a medium bug on the payment server.
Always combine CVSS with business context when you prioritize.
Likelihood and Impact
A simple, robust model for prioritization is risk = likelihood x impact.
Likelihood considers exploitability and exposure; impact considers what an attacker gains. A 5x5 matrix makes this visual.
Impact
High | Med | High | Crit
Med | Low | Med | High
Low | Low | Low | Med
+-------------------------
Low Med High
LikelihoodPrioritizing the Backlog
Sort findings so the client fixes the most dangerous, most reachable issues first.
A practical rule: anything Critical or High that is internet-facing and easy to exploit goes to the top of the list.
Priority 1: Critical + internet-facing
Priority 2: High + authenticated
Priority 3: Medium
Priority 4: Low / InformationalDocumenting Your Reasoning
Always show the vector string and the reasoning behind each score. A client may push back, and a transparent score is easy to defend.
Never just write a number. Write the number, the vector, and a sentence of justification.
Tools for Scoring
You do not compute CVSS by hand. Use the official FIRST CVSS calculator or built-in calculators in your reporting platform.
Paste the vector to verify the score is reproducible by anyone.
Quick Check
Test your understanding of risk scoring.
Recap
You learned how to score and prioritize risk.
- CVSS rates severity 0 to 10 across base, temporal, and environmental metrics.
- Severity bands: None, Low, Medium, High, Critical.
- Vector strings make a score reproducible and defensible.
- Business risk = likelihood x impact, not CVSS alone.
- Prioritize internet-facing critical issues first.
Next you will learn to write clear, actionable findings.
Frequently asked questions
Is the “Risk Scoring” lesson free?
Yes — the full text of “Risk Scoring” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Risk Scoring”?
CVSS and prioritization. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Risk Scoring” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.