Every observation carries a risk rating: Critical, High, Medium, Low, or Very Low. It's not a vibe, and it isn't pulled out of the air. It comes from two inputs, likelihood and impact, run through a fixed matrix. Here's the whole model: both scales as you'll see them in the app, the matrix itself, and why we made it a hand-tuned lookup instead of multiplying two numbers.
Two inputs, one output
Risk is how probable a thing is, crossed with how bad it would be. So a rating needs two inputs. You set the likelihood (how likely is this to actually happen) and the impact (how much damage if it does), and the risk rating derives from the pair automatically.
You cannot override the derived rating directly. If your judgement changes, adjust likelihood or impact and the rating follows the matrix automatically. The point of the scales is that two people on the same team land on the same answer. Vague words like “medium-ish” don't travel between people; a defined scale does.
The likelihood scale
Five levels, each pinned to a probability that the event happens within twelve months. The ranges aren't decoration. They turn a soft word into something two assessors can agree on, calibrated to the FE/DDIS yardstick (the same kind of probability scale intelligence analysts use so “likely” means the same thing to everyone reading it).
| Likelihood | In 12 months | What it means |
|---|---|---|
| Highly likely | >90% | Almost certain. Everything points to it happening. |
| Likely | 60-90% | Good reason to expect it. |
| Possible | 40-60% | Roughly even odds either way. |
| Less likely | 10-40% | Little reason to expect it. |
| Highly unlikely | <10% | Very little reason to expect it. |
The impact scale
Five levels, qualitative this time. No percentages, because consequence doesn't map cleanly to a number. It runs from a purely informational note up to the kind of thing that ends in a regulator's inbox.
| Impact | What it means |
|---|---|
| Very High | Immediate risk of a large-scale breach, full organisational compromise, or serious regulatory penalties. |
| High | Could directly enable sensitive data access, privilege escalation, or major service disruption. |
| Medium | Could contribute to a breach alongside other factors, or hit non-critical systems. |
| Low | A hardening or defence-in-depth gap that still gives an attacker marginal help. No direct path to data or disruption. |
| Very Low | Informational only. A best-practice deviation or already-public detail with no realistic attacker value on its own. |
The impact scale tops out at Very High on purpose. Critical is reserved for the output, the derived risk rating. Keeping the input and output labels distinct stops the two getting mixed up when you're reading a finding at a glance.
The matrix
Cross the two and you get the rating. Likelihood runs down the side, most likely at the top; impact runs across, most severe to the right. Worst case sits top-right, mildest bottom-left.
| Likelihood ↓ / Impact → | Very Low | Low | Medium | High | Very High |
|---|---|---|---|---|---|
| Highly likely | Low | Medium | High | Critical | Critical |
| Likely | Very Low | Low | Medium | High | Critical |
| Possible | Very Low | Low | Medium | High | High |
| Less likely | Very Low | Very Low | Low | Medium | High |
| Highly unlikely | Very Low | Very Low | Low | Medium | Medium |
The live matrix, exactly as the app derives it.
Here's the part worth knowing: this is a lookup table, not a multiplication. We didn't score likelihood 1 to 5, impact 1 to 4, and multiply. We sat down and set every cell by hand.
Why not just multiply?
Because multiplication is symmetric, and risk isn't. Multiply the numbers and “Less likely × Very High” scores the same as “Likely × Medium”. Those are not the same risk. A rare event that would wreck you deserves more weight than a routine event that stings a bit. The lookup lets impact outweigh likelihood at the top end: a Very High impact never drops below Medium, however unlikely it is.
The one rule the table always obeys is monotonicity. Raise the likelihood or raise the impact and the rating never goes down. Walk up any row or along any column and it only ever holds or climbs. That keeps it honest, and keeps it predictable.
What each rating means
The five ratings aren't just colours. Each one carries an implied urgency, which is the whole reason you rate a finding in the first place: to know what to do first.
| Critical | Unacceptable. Treat it now. |
| High | Significant. Prioritise it for mitigation. |
| Medium | Moderate. Plan a fix and keep an eye on it. |
| Low | Minor. Monitor, or accept it and move on. |
| Very Low | Negligible. Note it for the record, then monitor or accept. |
From rating to decision
The rating tells you how urgent. What you do about it is the treatment decision, and there are two:
- Mitigate. You're going to fix it. Track the recommendations, each moving Open, then In Progress, then Completed (or Won't Do). The observation reads Mitigating until they're all closed, then Mitigated.
- Accept. You're going to live with it, with eyes open. Record why in a justification (required, and stored encrypted). The observation reads Risk Accepted.
You don't set the status by hand. It's derived from the treatment decision and the state of the recommendations, so the register can never show “Mitigated” while work is still open.
Reassessing after you mitigate
The rating you set at the start is the inherent risk, the risk before your new controls land. Once you've actually done the mitigation, the real risk is lower. That's the residual risk, and the numbers should move to reflect it.
Once a finding is on the Mitigate path with recommendations in flight, you can run an AI reassessment. It reads the controls you've added and the recommendations you've closed, then proposes an updated likelihood, impact, and rating, with its reasoning. Nothing applies on its own. You review the proposal and accept it (or don't). The score stays yours; the AI just does the legwork of re-deriving it.
Likelihood and impact are the inputs. A hand-tuned 5×5 lookup turns them into one of Critical, High, Medium, Low, or Very Low. The rating sets urgency; the treatment decision sets the plan; reassessment keeps the number honest as you fix things.