What risk ratings don’t tell you.
A vulnerability appears in a penetration testing report.
Risk Rating: Low
It is easy to assume that a Low finding can be placed near the bottom of the ‘To Do’ list. There are Medium, High and Critical findings competing for attention, so surely the Low finding belongs somewhere near the bottom of the list?
Sometimes it does.
But that single word ‘Low’ does not tell you everything you need to know.
When that label is derived from a CVSS Base score, it gives a standardised view of the vulnerability’s intrinsic technical risk. It does not, by itself, assess the risk the finding presents to a particular organisation.
The finding tells you what was identified.
The rating helps describe its risk.
Understanding what it means in your environment requires another layer of thinking.
Low on its own does not always mean low in context…
A Low rating usually means that a weakness has limited technical impact or requires conditions that reduce its severity. That matters, and it should influence prioritisation. But the rating describes the finding as assessed, it does not guarantee that the finding will remain insignificant when it sits alongside other weaknesses.
Attackers are not limited to using one weakness at a time. Information disclosed by one issue may make another easier to exploit. A minor configuration error may expose a service that was assumed to be unreachable. Weak permissions may then allow access to something more sensitive. Each step can be modest in isolation, while the route created by those steps carries a much greater risk.
That does not turn every Low finding into a High one. The individual rating can remain Low while its contribution to a realistic attack path gives the organisation a reason to examine it more closely or treat it sooner.
A simple example
Imagine an internet-facing application with a weak password policy, no effective anti-automation controls, no multi-factor authentication and no restriction on concurrent logins. Assessed separately, each weakness may have limited impact or depend on other conditions before it can be exploited successfully.
Together, however, they create a much stronger route to account compromise. The weak password policy makes guessable or reused credentials more likely, while the absence of anti-automation controls allows repeated, automated login attempts. Without MFA, a correct password may be enough to gain access, and concurrent logins can allow an attacker to maintain a session without immediately displacing or alerting the legitimate user.
The individual findings have not automatically become High risk. What has changed is the understanding of how they interact. Together, they reduce the barriers to unauthorised access and may justify treating one or more of them as a higher remediation priority than their labels alone would suggest. The individual risks are Low, the aggregated risk is High
This is not necessarily an argument for fixing Low findings first
Critical and High findings will often demand the fastest response, particularly where exploitation is straightforward, important systems are exposed or serious impact has been demonstrated. They should not be ignored while a team investigates every theoretical combination of lower-risk issues.
The point is to avoid treating the risk rating column as the entire decision. A sound remediation plan considers technical risk alongside exploitability, exposure, asset importance, existing controls, threat intelligence and the way findings interact. Sometimes that confirms the original order. Sometimes it moves a Low risk finding higher because it closes an important route through the environment.
How can penetration testing help?
Automated scanning and risk ratings are useful for identifying and describing weaknesses, but they do not always show how an attacker could move between them. A penetration tester can investigate those relationships, validate whether a suspected path is and demonstrate what access or impact can be evidenced.
A useful report will still present individual findings clearly, but it will also explain relevant dependencies and attack paths. That gives the organisation a better basis for deciding what to remediate immediately, what to mitigate, what to monitor and what can reasonably be accepted for the time being.
How Runewall Security can help
Runewall Security looks beyond isolated labels to examine how weaknesses behave in the environment being tested. Our penetration testing considers the relationships between systems, access controls, exposed services and business relevant assets, helping to identify where an apparently modest issue contributes to a more meaningful route.
We report what was identified, what was demonstrated and why it matters in context. The aim is not to inflate every Low finding or overwhelm teams with noise. It is to provide clear evidence and practical recommendations so that attention and remediation effort are directed where they can reduce risk most effectively.
The finding is only the beginning…
A Low risk finding may be exactly what its rating suggests: limited, contained and appropriately placed below more serious work. But it may also be one step in a chain that changes the organisation’s exposure. The right response is neither to panic nor to dismiss it. It is to ask what the finding connects to, where it could lead and whether addressing it would break a more significant attack path.
Risk ratings start the conversation. Context, evidence and sound prioritisation determine what should happen next.