Stage 1 · Lesson 7 of 7
Severity when failures are probabilistic
A tester's findings are only useful if they are ranked well. Severity combines likelihood (how easy and how probable is it?) and impact (what does the attacker gain?). , the common 0 to 10 scale, works for classic bugs, and many teams adjust it for AI findings.
Two AI-specific points matter. First, many model failures are probabilistic: an issue that happens one time in fifty can still be serious if an attacker can retry for free, so record the rate. Second, impact depends on what the app can do, not on what the model said: an embarrassing answer is low impact, a tool call that leaks another user's data is high.
Common traprating every as critical, which teaches the team to ignore your reports.
A question to check yourself, an AI practice session and 1 cheat sheet entry come with the full roadmap. Unlock
Resources for this stage
Start with· follow one of these
- RoadmapFreeSefism Cybersecurity Roadmap
Sefism · Beginner
Sefism's general security roadmap, for any foundation in this stage you want to study in more depth
- CourseFreeProfessor Messer's Security+ (SY0-701) Course
Professor Messer · Beginner
Free videos covering the core security concepts, from access control to cryptography
Practise
Keep handy
Also worth your time
The four questions, diagrams and STRIDE in one practical page
- roadmap.sh: Cyber SecurityGo deeper
A map of the wider security field, so you know where AI testing sits