Risk & Severity - Snapsec Suite

CVSS base scores alone do not reflect real enterprise risk. A Critical CVSS 9.8 in a disconnected development sandbox presents far less risk than a Medium CVSS 5.3 on an internet-facing production payment gateway. Snapsec introduces TrueRisk™, an intelligent contextual scoring model.

TrueRisk™ Formulation

\text{TrueRisk} = f(\text{Base Severity}, \text{Asset Exposure}, \text{Asset Criticality}, \text{Threat Exploitability})

+--------------------------------------------------------------+
|                    TrueRisk™ Components                     |
+--------------------------------------------------------------+
| 1. Base Severity (CVSS v3.1): Mathematical impact & exploit  |
| 2. Asset Exposure: Internet-facing (ASM) vs Internal Private |
| 3. Asset Criticality: Tier 1 (Prod/PCI) vs Tier 4 (Sandbox)  |
| 4. Threat Intelligence: CISA KEV, EPSS Probability, Exploit |
+--------------------------------------------------------------+

Severity Bands

Severity	TrueRisk Score	Description	Default Remediation SLA
Critical	9.0 – 10.0	Actively exploited or high-impact flaw on critical perimeter	7 Calendar Days
High	7.0 – 8.9	Severe vulnerability requiring authentication or chained exploit	14 Calendar Days
Medium	4.0 – 6.9	Moderate risk, configuration flaw, or defense-in-depth gap	30 Calendar Days
Low	0.1 – 3.9	Informational finding, minor banner leakage, best practice	90 Calendar Days
Info	0.0	Discovery metadata, technology fingerprint	No SLA enforcement