Technique · Finding validation

Severity scoring

Scores a finding from separate evidence axes (impact, persistence, detectability, reachability, scope, certainty) instead of a single guess.

Sub-techniques

Impact category V1046.001

Data loss, security, crash, wrong behaviour, performance, leak or maintainability.
Persistence and detectability V1046.002

Transient, until restart or permanent; loud, silent or delayed.
Blast radius V1046.003

One operation, one user, a subset, broad or systemic.
Certainty basis V1046.004

Demonstrated by a run, traced in code, inferred from a name, or assumed.
Standard vulnerability scoring V1046.005

CVSS vectors, SSVC decisions and EPSS likelihood for security findings.