---
title: 06.01 Default Risk Scoring Method
description: SimpleRisk offers nine scoring methods and has no system-wide default; submitters pick one on the Submit Risk form. The one scoring setting an…
---
[Skip to content](https://support.simplerisk.com/kb/06-01-default-risk-scoring-method#main-content)
English
Show submenu for translations
[Customer portal](https://support.simplerisk.com/tickets?hsLang=en)
[](https://www.simplerisk.com/)
Open main navigation
Close main navigation
- English
Show submenu for translations
- [Customer portal](https://support.simplerisk.com/tickets)
- [Contact us](https://www.simplerisk.com/about-us/contact-us)
[Contact us](https://www.simplerisk.com/about-us/contact-us)
How can we help you?
- There are no suggestions because the search field is empty.
1. [SimpleRisk Knowledge Base](https://support.simplerisk.com/kb?hsLang=en)
2. [Administrator Guide](https://support.simplerisk.com/kb/administrator-guide?hsLang=en)
3. [06 Configuring Risk and Compliance](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#06-configuring-risk-and-compliance)
# 06.01 Default Risk Scoring Method
## SimpleRisk offers nine scoring methods and has no system-wide default; submitters pick one on the Submit Risk form. The one scoring setting an administrator controls is the Risk Model, which sets the formula the Classic method uses. Set at Settings cog → Risk Configuration → Classic Risk Formula.
## Why this matters
The scoring method is how SimpleRisk turns the judgments a submitter makes into a quantitative score that powers everything downstream: the dashboards, the SLA cadence, the heat map, the executive readouts. Pick the wrong approach and the program either over-emphasizes impact (every "could be bad" risk lands as Critical) or under-emphasizes it (only certain catastrophes ever break out of Medium). Pick the right one and the scores track the program's intuition about which risks matter.
What to know up front: **there is no system-wide default scoring method.** Each submitter picks a method from the **Risk Scoring Method** dropdown on the **Submit Risk** form, and nothing gates the choice. The one scoring setting an administrator controls is the **Risk Model** on the **Classic Risk Formula** tab, which sets the arithmetic the **Classic** method uses to combine impact and likelihood. It changes how Classic risks score. It has no effect on risks scored with any other method.
The methods differ in kind:
- **Classic** combines one impact and one likelihood using the formula you pick.
- **DREAD** and **OWASP** score from their own sets of factors.
- **CVSS v2.0**, **v3.0**, **v3.1**, and **v4.0** score from the metrics of the CVSS specification, entered one by one or pasted as a vector string. The score matches what the FIRST calculator gives for the same vector.
- **Custom** looks the score up in a matrix you define (Customization Extra).
- **Contributing Risk** takes a weighted sum across subjects you configure.
Programs that want one consistent methodology need to agree on it and communicate it. The system won't enforce it.
## Before you start
- **Admin access** to **Settings cog → Risk Configuration**. The **Scoring**, **Classic Risk Formula**, and **Contributing Risk Formula** tabs hold the scoring settings; Review Settings is the fourth tab.
- **A view on which method your program will standardize on.** Pick one for a year or more and let the program's intuition settle against it.
- **A test environment** if you're about to change the Risk Model. It rescores every existing Classic risk the moment you save.
## Step-by-step
### 1. Know what each method weighs
#### 1: **Classic**
- **How it scores:** One impact and one likelihood, combined by the Risk Model formula (see step 3).
#### 2: **CVSS v2.0**
- **How it scores:** The CVSS 2.0 base, temporal, and environmental metrics. Obsolete, but still supported.
#### 3: **DREAD**
- **How it scores:** Five DREAD factors.
#### 4: **OWASP**
- **How it scores:** The OWASP Risk Rating factors.
#### 5: **Custom**
- **How it scores:** Per-cell matrix lookup. Requires the Customization Extra.
#### 6: **Contributing Risk**
- **How it scores:** Weighted sum across admin-configured subjects; the weights must sum to 1.
#### 7: **CVSS v3.0**
- **How it scores:** The CVSS 3.0 metrics or a pasted vector string.
#### 8: **CVSS v3.1**
- **How it scores:** The CVSS 3.1 metrics or a pasted vector string.
#### 9: **CVSS v4.0**
- **How it scores:** The CVSS 4.0 metrics or a pasted vector string.
Each CVSS risk keeps a vector per version, so switching a risk from v3.1 to v4.0 and back brings the earlier entries back. See [The Risk Formula](https://support.simplerisk.com/kb/06-02-the-risk-formula?hsLang=en) for the exact behavior, and the user guide's [Risk Scoring Methodologies](https://support.simplerisk.com/kb/01-03-risk-scoring-methodologies?hsLang=en) for what submitters see.
### 2. Decide what to recommend to submitters
- **Vulnerability-driven programs** — a CVSS version. Use the newest one your scanner reports (v4.0 where available, otherwise v3.1).
- **Risk-averse or regulator-facing programs** — Classic with a formula that weights impact heavily.
- **Balanced security-engineering posture** — Classic with the plain Likelihood x Impact formula, or DREAD.
- **Threat-driven posture** — OWASP, or Classic with a likelihood-weighted formula.
- **Impact in several categories** — Contributing Risk.
- **None of the above fit** — Custom, with a matrix you define.
Most programs pick one or two and rarely change. Consistency matters more than the choice.
### 3. Choose the Classic formula (Risk Model)
Go to **Settings cog → Risk Configuration → Classic Risk Formula**. The **Risk** dropdown offers six formulas:
1. Likelihood x Impact + 2(Impact)
2. Likelihood x Impact + Impact
3. Likelihood x Impact
4. Likelihood x Impact + Likelihood
5. Likelihood x Impact + 2(Likelihood)
6. Custom
Select one and click **Update**. The same form has the **Normalize Scoring on a 0-10 Scale** switch. On save, SimpleRisk recalculates every existing risk scored with Classic and writes a scoring-history entry for each one whose score changed. Risks scored with other methods are untouched.
### 4. Configure the score-to-level mapping
The numeric score maps to a level (Insignificant, Low, Medium, High, Very High) through the thresholds on the **Scoring** tab. See [The Risk Formula](https://support.simplerisk.com/kb/06-02-the-risk-formula?hsLang=en). If a formula change moves the score range, check that the thresholds still spread risks sensibly.
### 5. Communicate the methodology
Scores travel into reports, dashboards, and audit responses. A change of formula moves scores without any risk changing. Tell stakeholders which method the program uses and why, announce formula changes, and re-baseline period-over-period metrics. Put the method name in report headers.
### 6. Verify with a few representative risks
Before announcing a choice or a change, take five to ten representative risks, work out the score by hand, and compare it with what SimpleRisk shows. If the levels don't match stakeholder intuition, the formula or the thresholds need adjusting.
## Common pitfalls
- **Changing the Risk Model in production without warning.** Every Classic risk rescores at once, and the High count can jump with no change in actual risk. Test first and announce.
- **Allowing every method without explaining the consequence.** Scores from different methods aren't directly comparable, so a register mixing many methods can't be sorted by score in a meaningful way. Encourage a small set.
- **Assuming a CVSS risk follows the Risk Model.** It doesn't. CVSS scores come from the vector alone. Changing the Risk Model never moves them.
- **Mixing CVSS versions without noticing.** A 9.8 under v3.1 and a 9.3 under v4.0 can describe the same flaw. Pick the version your scanners report and say so.
- **Misaligned thresholds.** If the score range and the level thresholds disagree, every risk lands in one level. Verify them together.
- **Using Custom (method 5) without the Customization Extra.** The method appears in the dropdown, but without the Extra the matrix isn't configured. Activate the Extra and configure the matrix, or use a different method.
- **Treating the formula as permanent.** Revisit it every couple of years. The change itself is cheap; the communication is the work.
- **Skipping the representative-risk check.** An hour of hand calculation beats a month of confusing reports.
## Related
- [The Risk Formula](https://support.simplerisk.com/kb/06-02-the-risk-formula?hsLang=en)
- [Risk Review Cadence](https://support.simplerisk.com/kb/06-03-risk-review-cadence?hsLang=en)
- [Custom Risk Scoring](https://support.simplerisk.com/kb/05-02-custom-risk-scoring?hsLang=en)
- [Custom Fields](https://support.simplerisk.com/kb/05-01-custom-fields?hsLang=en)
- [FAQs](https://support.simplerisk.com/kb/faqs?hsLang=en)
- [SimpleRisk Extras](https://support.simplerisk.com/kb/simplerisk-extras?hsLang=en#main-content)
- [Vulnerability Management Extra](https://support.simplerisk.com/kb/simplerisk-extras?hsLang=en#vulnerability-management-extra)
- [Team Separation Extra](https://support.simplerisk.com/kb/simplerisk-extras?hsLang=en#team-separation-extra)
- [Import-Export Extra](https://support.simplerisk.com/kb/simplerisk-extras?hsLang=en#import-export-extra)
- [Administrator Guide](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#main-content)
- [00 About This Guide](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#00-about-this-guide)
- [01 Installation and Deployment](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#01-installation-and-deployment)
- [02 Upgrades and Maintenance](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#02-upgrades-and-maintenance)
- [03 Users and Permissions](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#03-users-and-permissions)
- [04 Authentication](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#04-authentication)
- [05 Customization](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#05-customization)
- [06 Configuring Risk and Compliance](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#06-configuring-risk-and-compliance)
- [07 Integrations](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#07-integrations)
- [08 The API](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#08-the-api)
- [09 Encryption and Data Security](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#09-encryption-and-data-security)
- [10 Workflows and Automation](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#10-workflows-and-automation)
- [11 Reporting and Auditing](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#11-reporting-and-auditing)
- [12 Operations](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#12-operations)
- [13 Reference](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#13-reference)
- [User Guide](https://support.simplerisk.com/kb/user-guide?hsLang=en#main-content)
- [00 Foundations of GRC](https://support.simplerisk.com/kb/user-guide?hsLang=en#00-foundations-of-grc)
- [01 Risk Management](https://support.simplerisk.com/kb/user-guide?hsLang=en#01-risk-management)
- [02 Compliance Management](https://support.simplerisk.com/kb/user-guide?hsLang=en#02-compliance-management)
- [03 Governance](https://support.simplerisk.com/kb/user-guide?hsLang=en#03-governance)
- [04 Asset and Data Inventory](https://support.simplerisk.com/kb/user-guide?hsLang=en#04-asset-and-data-inventory)
- [05 Threat and Vulnerability Management](https://support.simplerisk.com/kb/user-guide?hsLang=en#05-threat-and-vulnerability-management)
- [06 Assessments](https://support.simplerisk.com/kb/user-guide?hsLang=en#06-assessments)
- [07 Incident Management](https://support.simplerisk.com/kb/user-guide?hsLang=en#07-incident-management)
- [08 Audit and Reporting](https://support.simplerisk.com/kb/user-guide?hsLang=en#08-audit-and-reporting)
- [09 Day-to-Day SimpleRisk](https://support.simplerisk.com/kb/user-guide?hsLang=en#09-day-to-day-simplerisk)
- [10 Continuous Improvement](https://support.simplerisk.com/kb/user-guide?hsLang=en#10-continuous-improvement)
- [SimpleRisk User Guides](https://support.simplerisk.com/kb/simplerisk-user-guides?hsLang=en)
- [Troubleshooting](https://support.simplerisk.com/kb/troubleshooting?hsLang=en)
- [SimpleRisk Hosted](https://support.simplerisk.com/kb/simplerisk-hosted?hsLang=en)
- [How To videos](https://support.simplerisk.com/kb/how-to-videos?hsLang=en)
[](https://www.simplerisk.com)
Copyright © 2026, SimpleRisk, Inc.