How are the severity ratings determined?

ANSWER  The findings within the platform are based on the CVSS scores of the findings that we identify. Some of the findings that we report on may not necessarily be publicly documented with a CVSS score; therefore, we calculate those CVSS scores ourselves based on experience and the industry's expectations of these types of findings.

Depending on the scenarios, we may adjust the severity of a finding if we're able to determine that, for example, a critical finding was not used to lead to a successful attack or compromise of systems/resources.