> ## Documentation Index
> Fetch the complete documentation index at: https://docs.snapsec.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Risk & Severity

> Understand the mathematical model behind TrueRisk™ scoring and severity ratings.

CVSS base scores alone do not reflect real enterprise risk. A Critical CVSS 9.8 in a disconnected development sandbox presents far less risk than a Medium CVSS 5.3 on an internet-facing production payment gateway.

Snapsec introduces **TrueRisk™**, an intelligent contextual scoring model.

***

## TrueRisk™ Formulation

$\text{TrueRisk} = f(\text{Base Severity}, \text{Asset Exposure}, \text{Asset Criticality}, \text{Threat Exploitability})$

```
+--------------------------------------------------------------+
|                    TrueRisk™ Components                     |
+--------------------------------------------------------------+
| 1. Base Severity (CVSS v3.1): Mathematical impact & exploit  |
| 2. Asset Exposure: Internet-facing (ASM) vs Internal Private |
| 3. Asset Criticality: Tier 1 (Prod/PCI) vs Tier 4 (Sandbox)  |
| 4. Threat Intelligence: CISA KEV, EPSS Probability, Exploit |
+--------------------------------------------------------------+
```

***

## Severity Bands

| Severity | TrueRisk Score | Description | Default Remediation SLA |
| :- | :- | :- | :- |
| **Critical** | 9.0 – 10.0 | Actively exploited or high-impact flaw on critical perimeter | 7 Calendar Days |
| **High** | 7.0 – 8.9 | Severe vulnerability requiring authentication or chained exploit | 14 Calendar Days |
| **Medium** | 4.0 – 6.9 | Moderate risk, configuration flaw, or defense-in-depth gap | 30 Calendar Days |
| **Low** | 0.1 – 3.9 | Informational finding, minor banner leakage, best practice | 90 Calendar Days |
| **Info** | 0.0 | Discovery metadata, technology fingerprint | No SLA enforcement |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.