# Severity Levels Explained

## What Severity Means

Severity indicates how important a finding is based on its potential impact and likelihood of exploitation.

It helps you prioritize which issues to address first.

---

## Severity Levels

Steel Security assigns each finding a severity level:

---

### High

High severity findings represent significant security risks.

These issues:

- may expose sensitive data  
- may allow unauthorized access or execution  
- are more likely to be targeted or exploited  

**Recommended Action:**  
Address these findings as soon as possible.

---

### Medium

Medium severity findings represent moderate risks.

These issues:

- may increase your site's attack surface  
- may contribute to larger vulnerabilities  
- are important but not immediately critical  

**Recommended Action:**  
Review and resolve these findings in a timely manner.

---

### Low

Low severity findings represent lower-risk issues.

These issues:

- may involve minor exposure or best-practice gaps  
- are less likely to be exploited directly  
- still contribute to overall security posture  

**Recommended Action:**  
Address these as part of routine maintenance.

---

## How Severity Is Determined

Severity is based on a combination of factors, including:

- potential impact if exploited  
- likelihood of exploitation  
- level of exposure  
- common attack patterns  

Severity provides guidance, but does not replace judgment.

---

## Severity Is Not Everything

While severity is important, it should not be the only factor in decision-making.

Consider:

- your specific environment  
- whether the behavior is intentional  
- how the finding relates to other risks  

Some lower severity findings may still be important in your context.

---

## How to Prioritize Findings

A practical approach:

1. address high severity findings first  
2. review medium severity findings next  
3. resolve low severity findings over time  

Also consider grouping related findings for more efficient fixes.

---

## Avoid Overreaction

Not every finding requires immediate action.

Steel Security is designed to surface risks, not create urgency where it is not needed.

Take a measured and informed approach.

---

## Key Principle

Severity helps guide your decisions, but effective security comes from applying multiple protections over time.

---

## Related

- [Understanding Scan Findings](https://docs.steelwp.com/books/findings-reference/page/understanding-scan-findings)
- [How Findings Are Categorized](https://docs.steelwp.com/books/findings-reference/page/how-findings-are-categorized)
- [Reviewing Findings](https://docs.steelsecurity.com/books/getting-started/page/reviewing-findings)