Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

All the main AV have a risk rating or severity level, how do they determine what is "low","high",etc.?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

Each company will use a different scale, but they all will likely be the result of a weighted score considering:

  • if it escalates itself
  • the damage it causes
  • if it disrupts communication
  • how hard it is to block/remove
  • how easy it is to get infected
  • how it gets passed on to other machines

Here is a similar scale: http://reviews.cnet.com/4520-6600_7-6274750-1.html

Symantec rates malware based on reputation and behavior classification and doesn't use a 'low-high' scale anymore.

share|improve this answer
Thank you, behavior classification sounds interesting, I'll have to check that out. –  rd42 Nov 8 '12 at 13:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.