Assess cybersecurity risks with industry-standard methods. Score inherent risk from likelihood and impact, apply CIA modifiers, find residual risk.
You might also find these calculators useful
Risk severity assessment is fundamental to cybersecurity management. This calculator implements ISO 27001 and NIST Cybersecurity Framework methodologies to help you quantify risks using a standard 5×5 matrix approach, applying CIA triad considerations and existing control effectiveness.
Risk severity is a measure of how serious a potential threat is, derived by combining the likelihood that an event occurs with the magnitude of its impact. Most frameworks express it as Severity = Likelihood × Impact, plotting the result on a risk matrix that ranges from low to critical. This lets teams rank and prioritize risks objectively rather than by intuition, focusing remediation on the highest-scoring items. This calculator multiplies your likelihood and impact ratings to produce a severity score and a corresponding qualitative level, mirroring standard risk-assessment methodologies used in cybersecurity and enterprise risk management.
A project manager rates each identified risk by likelihood and impact to prioritize the register for mitigation.
A team scores the severity of a proposed change to decide whether it needs extra sign-off before deployment.
An auditor assigns a consistent severity level to each finding so stakeholders can focus on the most critical ones.
An operations lead evaluates a workplace hazard by combining probability and consequence to guide corrective action.
Quantified risk scores help you allocate limited security budgets to the highest-impact threats.
Documented risk assessments show auditors and regulators that you follow structured risk management practices.
Transform subjective security concerns into objective scores that executives can compare and act upon.
Measure how security controls reduce residual risk over time and justify continued investment.
A 5×5 risk matrix plots likelihood (1-5) against impact (1-5) to create 25 possible risk positions. The resulting score (1-25) is typically grouped into risk levels: Minimal (1-4), Low (5-9), Medium (10-14), High (15-19), and Critical (20-25). This standardized approach enables consistent risk communication across organizations.
The CIA triad represents three core security objectives: Confidentiality (preventing unauthorized disclosure), Integrity (preventing unauthorized modification), and Availability (ensuring authorized access). Risks that impact multiple CIA elements are typically more severe and warrant higher priority.
Consider threat frequency from industry reports, your incident history, vulnerability exposure, and attacker motivation. For example, phishing attacks are 'Almost Certain' for most organizations, while sophisticated nation-state attacks may be 'Rare' for small businesses.
Inherent risk is the raw risk before any controls are applied. Residual risk is what remains after implementing security measures. Effective controls reduce likelihood, impact, or both. Your goal is to bring residual risk within acceptable tolerance levels.
ISO 27001 requires organizations to identify risks, assess likelihood and impact, and implement appropriate controls. This calculator follows ISO 27001's risk assessment methodology while incorporating NIST CSF's structured approach to categorization.
Critical risks (scores 20-25) typically require immediate executive attention and action. High risks (15-19) should be prioritized for near-term remediation. Medium risks (10-14) warrant documented treatment plans. Low and Minimal risks can be monitored or accepted with proper documentation.