Rating Risk Honestly

The fastest way to spot a junior report is that everything in it is High or Critical. Reflected XSS rated Critical. A missing HTTP header rated High. When a client sees that, they stop trusting the ratings entirely, and then they cannot tell your real Critical from your reflexive one. Severity is a currency, and printing too much of it makes all of it worthless.

CVSS is the common language for severity, and you should use it, but use it with your eyes open. The base score is a formula over a vector string, and the formula does not know anything about the specific environment you tested.

Read the vector, do not just copy the number

A CVSS 3.1 base vector is a set of metrics, and reading it tells you more than the single number it produces.

$CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H  =  9.8 Critical

The metrics that move the score most are the ones about how hard the attack is to reach. Attack Vector, Privileges Required, and User Interaction are the difference between a 9.8 and a 6.5. A bug with High confidentiality impact that requires you to already be domain admin (PR:H) is not a 9.8, and the vector will say so if you fill it in honestly instead of reaching for the scariest number.

Base score is a starting point, context is the finish

CVSS base is deliberately environment-blind. The same flaw can be a real Critical on an internet-facing app and a genuine Low on an internal box that already requires two other compromises to reach. That is what the Environmental and Temporal metrics are for, and it is also just good judgment.

Split it into likelihood and impact and reason about each. Impact is how bad it is if it happens. Likelihood is how plausible it is that someone reaches and triggers it given where it lives and what stands in front of it. An RCE behind three layers of auth, only reachable from a segment you need domain admin to enter, has severe impact and low likelihood, and the honest rating lands in the middle, not at the top.

When you adjust a rating down from the raw CVSS, write one sentence saying why. "Base CVSS is 9.8, adjusted to Medium because exploitation requires prior domain admin, which itself is Critical finding 1." That sentence is what separates a considered rating from a lazy one, and it is what makes the client trust the numbers you did leave high.

Not crying wolf is a long game

The value of your Critical rating comes entirely from the fact that you do not hand it out often. A report with two Criticals, both airtight, gets those two things fixed this week. A report with fifteen Criticals gets triaged by an overwhelmed team that picks a few at random and ignores the rest, including the ones that mattered. Restraint is not softness, it is what makes your severe findings act like emergencies.