OWASP Risk Calculator

Score a vulnerability with the full OWASP Risk Rating Methodology: eight likelihood factors, eight impact factors, one severity.

About OWASP Risk Calculator

Each of the sixteen factors is an ordinal 0–9 value taken from the published OWASP tables. The eight likelihood factors are averaged in two groups — how capable and motivated the threat agent is, and how easy the flaw is to find and exploit — then combined. Impact is the worse of the technical average and the business average, and the two banded scores are read off the 3×3 severity matrix. A repeatable severity that shows its working survives an argument with a product owner, whereas a gut-feel 'high' does not — and it makes two findings from two different testers comparable.

Formulas

OWASP Risk

Likelihood = mean(skill, motive, opportunity, size) averaged with mean(discovery, exploit, awareness, detection); impact = max(mean of the four technical factors, mean of the four business factors).

likelihood: 0–9 likelihood score
impact: 0–9 impact score
0–3 / 3–6 / 6–9: Low / Medium / High bands

Severity matrix

severityIndex = likelihoodBand + impactBand, where each band is 0 (Low), 1 (Medium) or 2 (High); 0 = Note, 1 = Low, 2 = Medium, 3 = High, 4 = Critical.

likelihoodBand: Band index of the likelihood score
impactBand: Band index of the impact score

Worked example

With the default values below, OWASP Risk Calculator returns Overall Risk Severity of Critical. Change any input above and every figure here is recalculated in your browser.

Inputs used

Threat agent — skill levelone of No technical skills — 1, Some technical skills — 3, Advanced computer user — 5, Network and programming skills — 6, Security penetration skills — 9: Network and programming skills — 6
Threat agent — motiveone of Low or no reward — 1, Possible reward — 4, High reward — 9: Possible reward — 4
Threat agent — opportunityone of Full access or expensive resources required — 0, Special access or resources required — 4, Some access or resources required — 7, No access or resources required — 9: Some access or resources required — 7
Threat agent — population sizeone of Developers or system administrators — 2, Intranet users — 4, Partners — 5, Authenticated users — 6, Anonymous internet users — 9: Anonymous internet users — 9
Vulnerability — ease of discoveryone of Practically impossible — 1, Difficult — 3, Easy — 7, Automated tools available — 9: Easy — 7
Vulnerability — ease of exploitone of Theoretical — 1, Difficult — 3, Easy — 5, Automated tools available — 9: Easy — 5
Vulnerability — awarenessone of Unknown — 1, Hidden — 4, Obvious — 6, Public knowledge — 9: Obvious — 6
Vulnerability — intrusion detectionone of Active detection in the application — 1, Logged and reviewed — 3, Logged without review — 8, Not logged — 9: Logged without review — 8
Technical — loss of confidentialityone of Minimal non-sensitive data disclosed — 2, Minimal critical data disclosed — 6, Extensive critical data disclosed — 7, All data disclosed — 9: Extensive critical data disclosed — 7
Technical — loss of integrityone of Minimal slightly corrupt data — 1, Minimal seriously corrupt data — 3, Extensive slightly corrupt data — 5, Extensive seriously corrupt data — 7, All data totally corrupt — 9: Extensive slightly corrupt data — 5
Technical — loss of availabilityone of Minimal secondary services interrupted — 1, Minimal primary services interrupted — 5, Extensive primary services interrupted — 7, All services completely lost — 9: Minimal primary services interrupted — 5
Technical — loss of accountabilityone of Fully traceable — 1, Possibly traceable — 7, Completely anonymous — 9: Possibly traceable — 7
Business — financial damageone of Less than the cost to fix — 1, Minor effect on annual profit — 3, Significant effect on annual profit — 7, Bankruptcy — 9: Significant effect on annual profit — 7
Business — reputation damageone of Minimal damage — 1, Loss of major accounts — 4, Loss of goodwill — 5, Brand damage — 9: Loss of major accounts — 4
Business — non-complianceone of Minor violation — 2, Clear violation — 5, High-profile violation — 7: Clear violation — 5
Business — privacy violationone of One individual — 3, Hundreds of people — 5, Thousands of people — 7, Millions of people — 9: Hundreds of people — 5

Results

Overall Risk Severity: Critical
Likelihood Score: 6.50 / 9
Technical Impact Score: 6.00 / 9
Business Impact Score: 5.25 / 9
Likelihood Level: High
Impact Level: High
Risk Score: 4.33 / 9

Step by step

1Values used
2OWASP Risk
3Severity matrix
4Overall Risk Severity= Critical
5Likelihood Score= 6.50 / 9
6Technical Impact Score= 6.00 / 9
7Business Impact Score= 5.25 / 9
8Likelihood Level= High
9Impact Level= High

Assumptions and limits

The result is derived only from the 16 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is OWASP Risk calculated?

Likelihood = mean(skill, motive, opportunity, size) averaged with mean(discovery, exploit, awareness, detection); impact = max(mean of the four technical factors, mean of the four business factors). Each of the sixteen factors is an ordinal 0–9 value taken from the published OWASP tables. The eight likelihood factors are averaged in two groups — how capable and motivated the threat agent is, and how easy the flaw is to find and exploit — then combined. Impact is the worse of the technical average and the business average, and the two banded scores are read off the 3×3 severity matrix.

Why does OWASP Risk matter?

A repeatable severity that shows its working survives an argument with a product owner, whereas a gut-feel 'high' does not — and it makes two findings from two different testers comparable.

What values do I need to enter?

This calculator takes 16 inputs: Threat agent — skill level, Threat agent — motive, Threat agent — opportunity, Threat agent — population size, Vulnerability — ease of discovery, Vulnerability — ease of exploit, Vulnerability — awareness, Vulnerability — intrusion detection, Technical — loss of confidentiality, Technical — loss of integrity, Technical — loss of availability, Technical — loss of accountability, Business — financial damage, Business — reputation damage, Business — non-compliance, Business — privacy violation. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Should I use technical impact or business impact?

Use business impact whenever you can estimate it, because it is what the organisation actually cares about. This calculator takes the worse of the two so that a finding is never under-rated when the business figures are unavailable or optimistic.

How does this relate to CVSS?

CVSS scores a vulnerability in the abstract for the whole world; OWASP risk rating scores it in your environment, with your threat agents, your detection capability and your data. They answer different questions, and a low CVSS finding can be a critical OWASP risk on an internet-facing app holding payment data.