Free Security Tool

OWASP Risk Calculator

Rate a vulnerability's likelihood and impact with the official OWASP Risk Rating Methodology.

Pick one option per factor, then Calculate Risk. Partial answers still give a result.

Likelihood Factors

Threat Agent Factors

0/4
Skill Level
How technically skilled is this group of threat agents?
Motive
How motivated is this group of threat agents to find and exploit this vulnerability?
Opportunity
What resources and opportunities are required for this group to exploit this vulnerability?
Size
How large is this group of threat agents?

Vulnerability Factors

0/4
Ease of Discovery
How easy is it for this group to discover this vulnerability?
Ease of Exploit
How easy is it for this group to actually exploit this vulnerability?
Awareness
How well known is this vulnerability to this group of threat agents?
Intrusion Detection
How likely is an exploit to be detected?

Impact Factors

Technical Impact

0/4
Loss of Confidentiality
How much data could be disclosed and how sensitive is it?
Loss of Integrity
How much data could be corrupted and how damaged is it?
Loss of Availability
How much service could be lost and how vital is it?
Loss of Accountability
Are the threat agents' actions traceable to an individual?

Business Impact

0/4
Financial Damage
How much financial damage will result from an exploit?
Reputation Damage
Would an exploit result in reputation damage that would harm the business?
Non-Compliance
How much exposure does non-compliance introduce?
Privacy Violation
How much personally identifiable information could be disclosed?

Get the full picture for your domain

Free recon check of your external footprint: headers, TLS, DNS, subdomains and CVE signals. Your report and a PDF summary, sent to your work email on that domain.

Free External Security Check

The official OWASP Risk Rating Methodology, step by step

This calculator follows the factor model of the official OWASP Risk Rating Methodology. It rates risk on two axes: likelihood (how probable an attack is) and impact (how damaging it would be). Each axis is built from sub-factors scored 0 to 9, combined into one rating so you prioritise consistently rather than by gut feel.

How likelihood and impact combine into overall risk

  • Likelihood: threat agent (skill, motive, opportunity, size) and vulnerability (ease of discovery, ease of exploit, awareness, intrusion detection).
  • Impact: technical (confidentiality, integrity, availability, accountability) and business (financial, reputation, non-compliance, privacy).

Each axis is averaged into one score, then the two combine into the overall rating. Scoring both is what separates OWASP from a purely technical score: a low-likelihood, high-impact flaw and a high-likelihood, low-impact one can land in very different places.

OWASP risk severity levels

  • Low (0 to 3): acceptable. Track it and revisit if the context changes.
  • Medium (3 to 6): fix in the normal course of work.
  • High (6 to 9): fix urgently, ahead of routine work.
  • Critical (9 and above): fix immediately.

A calculated score tells you how to prioritise, not whether the vulnerability is real.

Frequently asked questions

What is the OWASP Risk Rating Methodology?

The official OWASP framework for rating vulnerability severity. It scores likelihood, from threat agent and vulnerability factors, and impact, from technical and business factors, then combines them into an overall rating of low, medium, high or critical.

How does the OWASP risk calculator work?

Select one option for each factor. The calculator averages the likelihood factors and the impact factors, then combines the two into an overall risk score and severity band. You can calculate a partial result at any point and refine it as you add factors.

How is overall risk severity calculated from likelihood and impact?

Likelihood and impact are each scored from 0 to 9 and mapped to low, medium or high. A higher likelihood combined with a higher impact produces a higher overall severity, up to critical when both are severe.

How is OWASP risk rating different from CVSS?

CVSS focuses on the technical characteristics of a vulnerability. The OWASP Risk Rating adds business context such as financial damage, reputation, non-compliance and privacy, which suits prioritising work by business risk.

What are the OWASP risk severity levels?

Low (0 to 3), Medium (3 to 6), High (6 to 9) and Critical (9 and above). Higher bands mean the finding should be fixed sooner.