Hacktica
Security assessment framework
First-party vulnerability scoring

PSIRT Vulnerability Assessment Calculator

Classify the software condition, determine meaningful customer impact, set the fix priority, verify what was fixed, and translate the result into public-disclosure impact.

Developed by Lior Rotkovitch Hacktica · Standalone interactive HTML
Framing: Designed primarily for the PSIRT Security Engineer assessing first-party product vulnerabilities. Product Development may use it as supporting guidance. It is not a secure-code review or product-development security framework.
Assessment

Case and vulnerability gate

Confirm the software defect, the CIA-violating behavior, and whether the actor gains an unauthorized capability.

A–B

Software condition

The condition identifies the defect and the manipulation path. It supports remediation and fix verification; it does not determine severity by itself.

C + I

Software behavior and impact

Select the highest demonstrated impact in each domain. The overall technical severity is the highest domain result. No impact × likelihood multiplication is used.

Compute

Read configurations, tamper, install, execute, compromise a node, or take over the environment.

Data

Create, read, update, or delete system, service, PII, confidential, or secret data.

Service

Elevated load, random outage, partial loss of function, or core service unavailable.

Internal Low: The source model contains a Low fix-queue outcome, while its public-disclosure table begins at Sev 3 — Medium. This calculator therefore treats Low as an internal result below that table rather than inventing a public severity label.
D–E

Risk and exploitation context

Capture where the condition is exposed, the actor’s starting permissions, the execution context, affected scope, mission, and data sensitivity.

F

Exploit capability and evidence

Keep capability separate from evidence. Code execution describes what the exploit can do; theoretical, PoC, public exploit, and active exploitation describe how well it has been demonstrated.

Verification

What was fixed?

Differentiate a condition fix from a behavior-only prevention or compensating mitigation.