Direct answer
Confidence describes how strongly the evidence supports a finding; severity describes potential impact in context. A high-impact hypothesis can remain unconfirmed, and a confirmed low-impact configuration issue may still have limited urgency.
Describe what was observed
A tool may detect an outdated version, a reachable endpoint or an unusual response. Record the observed facts, collection conditions and rule that produced the alert. Do not call exploitation confirmed unless the agreed safe evidence establishes it.
Reference: NIST SP 800-115: Technical Guide to Information Security Testing and Assessment.
Assess impact separately
Ask which asset, users and data are affected, whether the path is reachable, and what controls may limit harm. For example, a suspected administrative exposure on an isolated test device may have a different priority from the same condition on a public production system.
- State confirmed facts and unverified assumptions.
- Include relevant reachability and asset criticality.
- Identify additional evidence needed to resolve uncertainty.
Assign a decision owner
The system owner can prioritize verification, a temporary mitigation or an immediate fix based on the risk and available evidence. If a candidate cannot be safely validated during the engagement, record it as unconfirmed with a reason and next step rather than dismissing or overstating it.
Reference: NIST SP 800-115: Technical Guide to Information Security Testing and Assessment.
Reassess after a change
A successful retest can confirm the specified condition was fixed under the retest's scope. It does not prove all related paths are secure. Preserve the original and later evidence separately and update the status without erasing the prior uncertainty.
Assessment limits
Severity and confidence labels depend on the assessment method and available context. They are decision aids, not proof of exploitation or a complete risk model.
Frequently asked questions
Can a high-severity alert be unconfirmed?
Yes. Potential impact and confidence in the observation are separate; describe both and the next verification step.
Does a CVSS score describe the whole business risk?
No. Consider the actual asset, exposure, controls and operational context alongside the score.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.