CyberGuard dictionary / Incident Response
Incident Severity
Incident severity is a ranking of the actual or potential impact of a security incident used to guide urgency, escalation, and response resources.
In simple terms
A minor blocked scan and an active theft of customer data should not receive identical handling. Severity can change as facts emerge.
Technical explanation
Criteria may include data sensitivity, service disruption, scope, safety, attacker persistence, and uncertainty. Teams should define levels in advance and revisit them as investigation confirms or rules out effects.
Severity translates observed or suspected impact into response urgency and escalation. Uncertainty should be explicit, and the level should change when new facts alter scope or consequence.
Examples in practice
An alert starts at medium severity, then moves to critical when investigators confirm active access to a production database.
An alert about one endpoint begins as moderate. When evidence shows access to sensitive production data, the incident commander raises severity and activates the broader response team.
Why it matters
Consistent severity criteria help teams notify the right decision makers and prioritize scarce response time.
VERIFY & LEARN MORE
Sources and further reading
Published 2026-10-15 · Last updated 2026-10-15 · CyberGuard editorial content. Source links provide context; they do not imply endorsement.