A new recipe for security risk evaluation

Security scans often return long lists of findings, and product teams need a way to decide which ones to fix first. The talk explains that a CVSS base score measures a vulnerability's technical severity in isolation, not its risk to a particular product. It then outlines a risk model used for many years, based on ISO 27005, in which vulnerabilities sit on supporting assets and threats aim at business assets.

The middle of the talk covers the open-source risk assessment tool built around that model. The tool walks users through assets, threats, likelihood questions, and controls, then produces a numeric score. The recent revision draws likelihood factors from the OWASP calculator and borrows two CVSS v3 factors, user interaction and scope, while avoiding overlap with criteria already counted. Those factors act as multipliers, and their constants were tuned by simulation against historical assessments.

A product management example shows the output in practice: a feature with a medium risk was dropped once the team weighed it against the small share of users who had requested it. The takeaway is to judge risk in business context rather than by severity alone. The speaker presented the new formula as still under evaluation and invited feedback from the community.