How We Rate Severity (and Why 'Critical' Is Rare Here)

Every article on this site carries one of five severity ratings. This guide documents what they mean and — because severity inflation is the industry’s default failure mode — the mechanical rules we apply to resist it.

The five levels

• Critical — active, in-the-wild exploitation of something with serious impact. The story is “this is happening to organisations now.”
• High — a serious vulnerability or campaign with credible exploitation grounding, or a major incident: significant but not a confirmed everyone-patch-tonight emergency.
• Medium — noteworthy threats and vulnerabilities without evidence of active exploitation; the bulk of real security news.
• Low — patched, contained or largely theoretical issues; hygiene items.
• Info — context, research, policy and industry news with no direct call to action.

Why the top ratings are gated on exploitation

Ratings here start from the same premise as our CVSS guide: structural severity and real-world urgency are different things, and only exploitation evidence bridges them.

We learned this the hard way. Left to itself, our editorial pipeline rated nearly two-thirds of all coverage high-or-critical — most cited no exploitation evidence at all, which makes the label meaningless: a rating that fires on most stories ranks nothing. So the calibration is now enforced mechanically, after generation, by rules that read the article’s own text:

• Critical is downgraded to High when the article shows no in-the-wild exploitation.
• High is downgraded to Medium on the same missing grounding.
• Medium is downgraded to Low for issues that are both patched and not exploited.

The effect is deliberate asymmetry: a quiet Medium that later gains an exploit gets re-covered at the higher level, but a loud Critical that never had evidence never earns the label in the first place.

What the label cannot tell you

Severity here rates the story, not your environment. A Critical about software you do not run is trivia; a Medium about the VPN appliance at your network edge is your week. Combine the rating with the article’s CVE data — each tracked CVE links to its own page with KEV status and deadlines — and with your own inventory.

Using the ratings as feeds

The rating system is queryable: per-severity RSS feeds exist at /rss/critical.xml and the equivalents for high, medium, low and info, and the free JSON API exposes the current severity mix across the corpus. If you only automate one thing, subscribing to the critical feed is the highest signal-to-noise option this site offers.