# Severity ratings and CVSS metrics
<a name="severity-and-cvss"></a>

AWS Security Agent assigns each finding a severity rating, and penetration test findings also include a CVSS (Common Vulnerability Scoring System) metrics breakdown. Use this reference to interpret those values when you review findings.

## Severity levels
<a name="_severity_levels"></a>

Each finding includes a color-coded severity badge that shows its risk level:
+  **Critical** (red) – Requires immediate action; exploitation could lead to system compromise
+  **High** (red) – Requires prompt attention; exploitation could result in significant security impact
+  **Medium** (orange) – Should be addressed in a reasonable timeframe; contributes to overall security risk
+  **Low** (yellow) – Can be addressed as part of regular maintenance; minimal immediate risk
+  **Informational** (blue) – For informational purposes; minimal to no immediate risk

## CVSS metrics
<a name="_cvss_metrics"></a>

Penetration test findings include a CVSS metrics breakdown in the finding’s **Risk Reasoning** section. These metrics explain how AWS Security Agent calculated the severity and help you assess the true risk:
+  **Attack Vector** (Network, Adjacent, Local, or Physical) – How remotely the attack can be executed
+  **Attack Complexity** (Low or High) – Whether specialized conditions are required to exploit the vulnerability
+  **Privileges Required** (None, Low, or High) – The access level an attacker needs
+  **User Interaction** (None or Required) – Whether the exploit needs user involvement
+  **Scope** – Whether the vulnerability affects components beyond the vulnerable one
+  **Confidentiality, Integrity, and Availability impact** (None, Low, or High) – The impact on your system’s security

**Important**  
Findings with a Network attack vector, Low attack complexity, and High confidentiality or integrity impact represent the most dangerous vulnerabilities and require immediate attention.