OWASP Risk Calculator

Score a vulnerability with the full OWASP Risk Rating Methodology: eight likelihood factors, eight impact factors, one severity.

Inputs

Threat agent — skill level

Threat agent — motive

Threat agent — opportunity

Threat agent — population size

Vulnerability — ease of discovery

Vulnerability — ease of exploit

Vulnerability — awareness

Vulnerability — intrusion detection

Technical — loss of confidentiality

Technical — loss of integrity

Technical — loss of availability

Technical — loss of accountability

Business — financial damage

Business — reputation damage

Business — non-compliance

Business — privacy violation

Overall Risk Severity

Critical

Likelihood Score

6.50/ 9

Technical Impact Score

6.00/ 9

Business Impact Score

5.25/ 9

Likelihood Level

High

Impact Level

High

Risk Score

4.33/ 9

Step by step

Values used
Threat agent — skill level = Network and programming skills — 6; Threat agent — motive = Possible reward — 4; Threat agent — opportunity = Some access or resources required — 7; Threat agent — population size = Anonymous internet users — 9; Vulnerability — ease of discovery = Easy — 7; Vulnerability — ease of exploit = Easy — 5; Vulnerability — awareness = Obvious — 6; Vulnerability — intrusion detection = Logged without review — 8; Technical — loss of confidentiality = Extensive critical data disclosed — 7; Technical — loss of integrity = Extensive slightly corrupt data — 5; Technical — loss of availability = Minimal primary services interrupted — 5; Technical — loss of accountability = Possibly traceable — 7; Business — financial damage = Significant effect on annual profit — 7; Business — reputation damage = Loss of major accounts — 4; Business — non-compliance = Clear violation — 5; Business — privacy violation = Hundreds of people — 5
OWASP Risk
Likelihood = mean(skill, motive, opportunity, size) averaged with mean(discovery, exploit, awareness, detection); impact = max(mean of the four technical factors, mean of the four business factors).
Severity matrix
severityIndex = likelihoodBand + impactBand, where each band is 0 (Low), 1 (Medium) or 2 (High); 0 = Note, 1 = Low, 2 = Medium, 3 = High, 4 = Critical.
Overall Risk Severity
= Critical
Likelihood Score
= 6.50 / 9
Technical Impact Score
= 6.00 / 9
Business Impact Score
= 5.25 / 9
Likelihood Level
= High
Impact Level
= High

How it works

Each of the sixteen factors is an ordinal 0–9 value taken from the published OWASP tables. The eight likelihood factors are averaged in two groups — how capable and motivated the threat agent is, and how easy the flaw is to find and exploit — then combined. Impact is the worse of the technical average and the business average, and the two banded scores are read off the 3×3 severity matrix. A repeatable severity that shows its working survives an argument with a product owner, whereas a gut-feel 'high' does not — and it makes two findings from two different testers comparable.

Formulas

OWASP Risk

Likelihood = mean(skill, motive, opportunity, size) averaged with mean(discovery, exploit, awareness, detection); impact = max(mean of the four technical factors, mean of the four business factors).

likelihood: 0–9 likelihood score
impact: 0–9 impact score
0–3 / 3–6 / 6–9: Low / Medium / High bands

Severity matrix

severityIndex = likelihoodBand + impactBand, where each band is 0 (Low), 1 (Medium) or 2 (High); 0 = Note, 1 = Low, 2 = Medium, 3 = High, 4 = Critical.

likelihoodBand: Band index of the likelihood score
impactBand: Band index of the impact score

Frequently Asked Questions

How is OWASP Risk calculated?

Likelihood = mean(skill, motive, opportunity, size) averaged with mean(discovery, exploit, awareness, detection); impact = max(mean of the four technical factors, mean of the four business factors). Each of the sixteen factors is an ordinal 0–9 value taken from the published OWASP tables. The eight likelihood factors are averaged in two groups — how capable and motivated the threat agent is, and how easy the flaw is to find and exploit — then combined. Impact is the worse of the technical average and the business average, and the two banded scores are read off the 3×3 severity matrix.

Why does OWASP Risk matter?

A repeatable severity that shows its working survives an argument with a product owner, whereas a gut-feel 'high' does not — and it makes two findings from two different testers comparable.

What values do I need to enter?

This calculator takes 16 inputs: Threat agent — skill level, Threat agent — motive, Threat agent — opportunity, Threat agent — population size, Vulnerability — ease of discovery, Vulnerability — ease of exploit, Vulnerability — awareness, Vulnerability — intrusion detection, Technical — loss of confidentiality, Technical — loss of integrity, Technical — loss of availability, Technical — loss of accountability, Business — financial damage, Business — reputation damage, Business — non-compliance, Business — privacy violation. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Should I use technical impact or business impact?

Use business impact whenever you can estimate it, because it is what the organisation actually cares about. This calculator takes the worse of the two so that a finding is never under-rated when the business figures are unavailable or optimistic.

How does this relate to CVSS?

CVSS scores a vulnerability in the abstract for the whole world; OWASP risk rating scores it in your environment, with your threat agents, your detection capability and your data. They answer different questions, and a low CVSS finding can be a critical OWASP risk on an internet-facing app holding payment data.

You might also need

Web Application Security Score Calculator SQL Injection Risk Calculator Remote Code Execution Risk Calculator