# How We Rate Severity (and Why 'Critical' Is Rare Here)

> The exact rules behind RuntimeRebel's five severity levels: what each one requires, why exploitation evidence gates the top ratings, and what the labels can't tell you.

- Published: 2026-08-05T00:00:00.000Z
- Tags: Severity, Editorial
- Author: RuntimeRebel Editorial
- Canonical: https://runtimerebel.com/guides/how-we-rate-severity

Every article on this site carries one of five severity ratings. This guide
documents what they mean and — because severity inflation is the industry's
default failure mode — the mechanical rules we apply to resist it.

## The five levels

- **Critical** — active, in-the-wild exploitation of something with serious
  impact. The story is "this is happening to organisations now."
- **High** — a serious vulnerability or campaign with credible exploitation
  grounding, or a major incident: significant but not a confirmed
  everyone-patch-tonight emergency.
- **Medium** — noteworthy threats and vulnerabilities without evidence of
  active exploitation; the bulk of real security news.
- **Low** — patched, contained or largely theoretical issues; hygiene items.
- **Info** — context, research, policy and industry news with no direct
  call to action.

## Why the top ratings are gated on exploitation

Ratings here start from the same premise as our
[CVSS guide](/guides/how-to-read-a-cvss-score): structural severity and
real-world urgency are different things, and only exploitation evidence
bridges them.

We learned this the hard way. Left to itself, our editorial pipeline rated
nearly two-thirds of all coverage high-or-critical — most cited no
exploitation evidence at all, which makes the label meaningless: a rating
that fires on most stories ranks nothing. So the calibration is now enforced
mechanically, after generation, by rules that read the article's own text:

- **Critical is downgraded to High** when the article shows no in-the-wild
  exploitation.
- **High is downgraded to Medium** on the same missing grounding.
- **Medium is downgraded to Low** for issues that are both patched and not
  exploited.

The effect is deliberate asymmetry: a quiet Medium that later gains an
exploit gets re-covered at the higher level, but a loud Critical that never
had evidence never earns the label in the first place.

## What the label cannot tell you

Severity here rates the *story*, not your environment. A Critical about
software you do not run is trivia; a Medium about the VPN appliance at your
network edge is your week. Combine the rating with the article's CVE data —
each tracked CVE links to [its own page](/cve) with KEV status and deadlines —
and with your own inventory.

## Using the ratings as feeds

The rating system is queryable: per-severity RSS feeds exist at
[/rss/critical.xml](/rss/critical.xml) and the equivalents for high, medium,
low and info, and the [free JSON API](/api-docs) exposes the current severity
mix across the corpus. If you only automate one thing, subscribing to the
critical feed is the highest signal-to-noise option this site offers.

---

Curated evergreen guide, produced with AI assistance and maintained by the site (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/guides/how-we-rate-severity