Vulnerability Risk Calculator

Includes compensating controls (preventive + detect/respond) in the risk and severity calculation.

Base Score

Select base metric

CVSS base score SAST severity rating

CVSS Base Score (0–10) Latest CVSS base score; normalized internally to 0–1.

Application Profile

Application profile Select a profile to load preset likelihood, impact, and compensating controls.

Likelihood Inputs

Exposure (E)

Exploitability / EPSS (X)

Threat Activity (T)

Attack Path (P)

Impact Inputs

Asset Criticality (C)

Data Sensitivity (D)

Environment (Env)

Compensating Controls

Model preventive controls (PC) and detect/respond controls (DR) using base × coverage × assurance × relevance/response. PC is capped at 0.60, DR at 0.40.

Preventive Controls

Detect / Respond Controls

Mitigation Factor

Legacy mitigation factor (M)

Use if you still track a coarse mitigation multiplier. Set to 1.0 if superseded by compensating controls.

Override Guardrails

KEV + internet exposed + CVSS ≥ 7.0 (force P0) Wormable unauthenticated RCE on production perimeter (force P0) Privilege escalation to domain / tenant-wide admin on crown-jewel identity (force P0) No viable path & strong isolation proof (force P4)

Guardrails apply before numeric scoring. Severity will not drop below P1 when KEV + internet exposed + CVSS ≥ 7.0.

Risk Result

Risk Score: —

Severity: —

Base: —
Likelihood (L): —
Impact (I): —
Mitigation (M): —
Preventive (PC): —
Detect/Respond (DR): —