06.01 Default Risk Scoring Method

Why this matters

The scoring method is how SimpleRisk turns the judgments a submitter makes into a quantitative score that powers everything downstream: the dashboards, the SLA cadence, the heat map, the executive readouts. Pick the wrong approach and the program either over-emphasizes impact (every "could be bad" risk lands as Critical) or under-emphasizes it (only certain catastrophes ever break out of Medium). Pick the right one and the scores track the program's intuition about which risks matter.

What to know up front: there is no system-wide default scoring method. Each submitter picks a method from the Risk Scoring Method dropdown on the Submit Risk form, and nothing gates the choice. The one scoring setting an administrator controls is the Risk Model on the Classic Risk Formula tab, which sets the arithmetic the Classic method uses to combine impact and likelihood. It changes how Classic risks score. It has no effect on risks scored with any other method.

The methods differ in kind:

Classic combines one impact and one likelihood using the formula you pick.
DREAD and OWASP score from their own sets of factors.
CVSS v2.0, v3.0, v3.1, and v4.0 score from the metrics of the CVSS specification, entered one by one or pasted as a vector string. The score matches what the FIRST calculator gives for the same vector.
Custom looks the score up in a matrix you define (Customization Extra).
Contributing Risk takes a weighted sum across subjects you configure.

Programs that want one consistent methodology need to agree on it and communicate it. The system won't enforce it.

Before you start

Admin access to Settings cog → Risk Configuration. The Scoring, Classic Risk Formula, and Contributing Risk Formula tabs hold the scoring settings; Review Settings is the fourth tab.
A view on which method your program will standardize on. Pick one for a year or more and let the program's intuition settle against it.
A test environment if you're about to change the Risk Model. It rescores every existing Classic risk the moment you save.

Step-by-step

1. Know what each method weighs

1: Classic

How it scores: One impact and one likelihood, combined by the Risk Model formula (see step 3).

2: CVSS v2.0

How it scores: The CVSS 2.0 base, temporal, and environmental metrics. Obsolete, but still supported.

3: DREAD

How it scores: Five DREAD factors.

4: OWASP

How it scores: The OWASP Risk Rating factors.

5: Custom

How it scores: Per-cell matrix lookup. Requires the Customization Extra.

6: Contributing Risk

How it scores: Weighted sum across admin-configured subjects; the weights must sum to 1.

7: CVSS v3.0

How it scores: The CVSS 3.0 metrics or a pasted vector string.

8: CVSS v3.1

How it scores: The CVSS 3.1 metrics or a pasted vector string.

9: CVSS v4.0

How it scores: The CVSS 4.0 metrics or a pasted vector string.

Each CVSS risk keeps a vector per version, so switching a risk from v3.1 to v4.0 and back brings the earlier entries back. See The Risk Formula for the exact behavior, and the user guide's Risk Scoring Methodologies for what submitters see.

2. Decide what to recommend to submitters

Vulnerability-driven programs — a CVSS version. Use the newest one your scanner reports (v4.0 where available, otherwise v3.1).
Risk-averse or regulator-facing programs — Classic with a formula that weights impact heavily.
Balanced security-engineering posture — Classic with the plain Likelihood x Impact formula, or DREAD.
Threat-driven posture — OWASP, or Classic with a likelihood-weighted formula.
Impact in several categories — Contributing Risk.
None of the above fit — Custom, with a matrix you define.

Most programs pick one or two and rarely change. Consistency matters more than the choice.

3. Choose the Classic formula (Risk Model)

Go to Settings cog → Risk Configuration → Classic Risk Formula. The Risk dropdown offers six formulas:

Likelihood x Impact + 2(Impact)
Likelihood x Impact + Impact
Likelihood x Impact
Likelihood x Impact + Likelihood
Likelihood x Impact + 2(Likelihood)
Custom

Select one and click Update. The same form has the Normalize Scoring on a 0-10 Scale switch. On save, SimpleRisk recalculates every existing risk scored with Classic and writes a scoring-history entry for each one whose score changed. Risks scored with other methods are untouched.

4. Configure the score-to-level mapping

The numeric score maps to a level (Insignificant, Low, Medium, High, Very High) through the thresholds on the Scoring tab. See The Risk Formula. If a formula change moves the score range, check that the thresholds still spread risks sensibly.

5. Communicate the methodology

Scores travel into reports, dashboards, and audit responses. A change of formula moves scores without any risk changing. Tell stakeholders which method the program uses and why, announce formula changes, and re-baseline period-over-period metrics. Put the method name in report headers.

6. Verify with a few representative risks

Before announcing a choice or a change, take five to ten representative risks, work out the score by hand, and compare it with what SimpleRisk shows. If the levels don't match stakeholder intuition, the formula or the thresholds need adjusting.

Common pitfalls

Changing the Risk Model in production without warning. Every Classic risk rescores at once, and the High count can jump with no change in actual risk. Test first and announce.
Allowing every method without explaining the consequence. Scores from different methods aren't directly comparable, so a register mixing many methods can't be sorted by score in a meaningful way. Encourage a small set.
Assuming a CVSS risk follows the Risk Model. It doesn't. CVSS scores come from the vector alone. Changing the Risk Model never moves them.
Mixing CVSS versions without noticing. A 9.8 under v3.1 and a 9.3 under v4.0 can describe the same flaw. Pick the version your scanners report and say so.
Misaligned thresholds. If the score range and the level thresholds disagree, every risk lands in one level. Verify them together.
Using Custom (method 5) without the Customization Extra. The method appears in the dropdown, but without the Extra the matrix isn't configured. Activate the Extra and configure the matrix, or use a different method.
Treating the formula as permanent. Revisit it every couple of years. The change itself is cheap; the communication is the work.
Skipping the representative-risk check. An hour of hand calculation beats a month of confusing reports.