Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

All the main AV have a risk rating or severity level, how do they determine what is "low","high",etc.?

share|improve this question
up vote 3 down vote accepted

Each company will use a different scale, but they all will likely be the result of a weighted score considering:

  • if it escalates itself
  • the damage it causes
  • if it disrupts communication
  • how hard it is to block/remove
  • how easy it is to get infected
  • how it gets passed on to other machines

Here is a similar scale:

Symantec rates malware based on reputation and behavior classification and doesn't use a 'low-high' scale anymore.

share|improve this answer
Thank you, behavior classification sounds interesting, I'll have to check that out. – rd42 Nov 8 '12 at 13:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.