Security Incident Classification: Category, Impact, Severity, and Confidence

Short answer: Classify an incident with separate fields for category, impact, severity, urgency, confidence, owner, and escalation. Use a provisional value when facts are incomplete, then update the classification as evidence improves.

Separate the terms

Category: what kind of incident is it, such as phishing, unauthorised access, malware, or service disruption?
Impact: what harm is known or possible?
Severity: the priority assigned using the organisation’s criteria.
Urgency: how quickly action is needed.
Confidence: how certain the team is that the signal and assessment are correct.

Keeping these separate stops a noisy alert from becoming a high-severity incident without evidence.

Use a first-pass decision

At intake, record the known facts, affected asset or service, data sensitivity, business process, current impact, and next action. Assign the lowest defensible provisional severity and a review time when more context is expected. Do not delay containment while waiting for a perfect label.

Define escalation triggers

Document what changes severity or ownership: privileged-account involvement, sensitive data, material availability impact, supplier or customer exposure, active spread, legal or contractual notification, or inability to contain. The owner should be able to explain which trigger was met.

Reclassify openly

Keep the original value and record why it changed. A changed severity is not necessarily a process failure; hiding the change is. Use the history to improve the criteria and training.

Practical example

A suspicious OAuth grant may initially be category “unauthorised access,” impact “unknown,” severity “provisional,” and confidence “low.” After identity and application logs are checked, the analyst can update those fields without losing the original classification or the reason for the change.

FAQ

Should severity be permanent at intake?

No. Record a provisional value when facts are incomplete and update it as evidence improves, keeping the reason and history visible.

Why separate category, impact, and confidence?

They answer different questions. Separating them prevents a low-confidence suspicion from being mistaken for low impact or a category from being used as severity.