Every observation carries a risk rating: Critical, High, Medium, Low, or Very Low. It's not a vibe, and it isn't pulled out of the air. It comes from two inputs, likelihood and impact, run through a fixed matrix. Here are both scales, how to read the matrix, and how an administrator sets the organisation's risk appetite.
Two inputs, one output
Risk is how probable a thing is, crossed with how bad it would be. So a rating needs two inputs. You set the likelihood (how likely is this to actually happen) and the impact (how much damage if it does), and the risk rating derives from the pair automatically.
You cannot override the derived rating directly. If your judgement changes, adjust likelihood or impact and the rating follows the matrix automatically. The point of the scales is that two people on the same team land on the same answer. Vague words like “medium-ish” don't travel between people; a defined scale does.
The likelihood scale
Five levels, each pinned to a probability that the event happens within twelve months. The ranges aren't decoration. They turn a soft word into something two assessors can agree on, calibrated to the FE/DDIS yardstick (the same kind of probability scale intelligence analysts use so “likely” means the same thing to everyone reading it).
| Likelihood | In 12 months | What it means |
|---|---|---|
| Highly likely | >90% | Almost certain. Everything points to it happening. |
| Likely | 60-90% | Good reason to expect it. |
| Possible | 40-60% | Roughly even odds either way. |
| Less likely | 10-40% | Little reason to expect it. |
| Highly unlikely | <10% | Very little reason to expect it. |
The impact scale
Five levels, qualitative this time. No percentages, because consequence doesn't map cleanly to a number. It runs from a purely informational note up to the kind of thing that ends in a regulator's inbox.
| Impact | What it means |
|---|---|
| Very High | Immediate risk of a large-scale breach, full organisational compromise, or serious regulatory penalties. |
| High | Could directly enable sensitive data access, privilege escalation, or major service disruption. |
| Medium | Could contribute to a breach alongside other factors, or hit non-critical systems. |
| Low | A hardening or defence-in-depth gap that still gives an attacker marginal help. No direct path to data or disruption. |
| Very Low | Informational only. A best-practice deviation or already-public detail with no realistic attacker value on its own. |
The impact scale tops out at Very High on purpose. Critical is reserved for the output, the derived risk rating. Keeping the input and output labels distinct stops the two getting mixed up when you're reading a finding at a glance.
The matrix
Likelihood runs down the side and impact across the top. Each pair maps to a fixed rating.
| Likelihood ↓ / Impact → | Very Low | Low | Medium | High | Very High |
|---|---|---|---|---|---|
| Highly likely | Low | Medium | High | Critical | Critical |
| Likely | Very Low | Low | Medium | High | Critical |
| Possible | Very Low | Low | Medium | High | High |
| Less likely | Very Low | Very Low | Low | Medium | High |
| Highly unlikely | Very Low | Very Low | Low | Medium | Medium |
The live matrix, exactly as the app derives it.
We use a lookup table rather than multiplying scores. That lets severe consequences retain weight even when they are unlikely. For example, Highly Unlikely likelihood + Very High impact = Medium risk, the bottom-right cell. Increasing either input never lowers the rating.
What each rating means
The five ratings aren't just colours. Each one carries an implied urgency, which is the whole reason you rate a finding in the first place: to know what to do first.
| Critical | Unacceptable. Treat it now. |
| High | Significant. Prioritise it for mitigation. |
| Medium | Moderate. Plan a fix and keep an eye on it. |
| Low | Minor. Monitor, or accept it and move on. |
| Very Low | Negligible. Note it for the record, then monitor or accept. |
Set your organisation's risk appetite
Risk appetite is the level of risk your organisation is willing to tolerate. In SecurityTrackr, you express it by marking the likelihood-and-impact combinations that require treatment. By default, every cell rated High or Critical is outside appetite; the other cells are within appetite.
An organisation administrator can change this in the app:
- Open Account → Organisation → Risk appetite.
- Click a matrix cell to mark that combination out of appetite. Click it again to remove the mark. Unmarked cells are within appetite.
- Click Save organisation to apply the changes.
You choose individual combinations, not just a risk-rating band. For example, you could mark Highly Unlikely likelihood with Very High impact as outside appetite because your organisation cannot tolerate that consequence. Its risk rating stays Medium; the appetite setting says it still needs treatment.
Changing appetite does not change an observation's likelihood, impact or derived rating. It changes whether that combination is within your organisation's tolerance. To restore the starting policy, click Reset to default, then Save organisation.
The treatment guide explains how to record a decision and track the work for findings outside appetite.
The rating includes controls already in place
SecurityTrackr assesses residual risk: the risk remaining with the controls currently in place. That is the rating shown on an observation, including its first assessment. Inherent risk, the hypothetical risk without controls, is not displayed separately in the app.
Describe existing controls accurately. A planned fix is not yet a control. When mitigation changes the situation, record what was deployed and reassess. In the app, you review the proposed scores and reasoning before applying them. A completed task does not automatically lower the risk rating.