How are cyber security breaches classified by severity?

There is no single universal definition of low, moderate, high or critical severity. Businesses normally classify a cyber security breach by assessing the level of risk it creates, the systems and information involved, the people or organisations affected, and the actions needed to contain and recover from it. The classification should reflect the organisation’s own risk appetite, regulatory duties and operational dependencies rather than relying on the technical label attached to an alert.

Severity is not determined by the number of affected devices alone. A single compromised administrator account may warrant a higher classification than a larger number of isolated malware detections because it could provide access to sensitive systems, allow security controls to be changed or enable further compromise. Similarly, an incident affecting a non-essential test environment may be less severe than one involving a smaller production system that supports essential business processes.

A sound assessment considers several factors:

• Information involved: whether the breach concerns publicly available material, internal business information, personal data, financial records, intellectual property, credentials or commercially sensitive information.
• Access obtained: whether the attacker could only view information, or could alter records, create accounts, deploy software, disable controls or administer infrastructure.
• Extent of compromise: whether the activity is confined to one account or endpoint, or has moved between systems, sites, cloud services or third parties.
• Operational effect: whether normal work can continue, whether manual workarounds are available and whether essential services or customer-facing functions are unavailable.
• Confidence and uncertainty: whether the organisation knows what happened, or whether important evidence is missing and the possible extent of the breach remains unclear.
• Legal and contractual consequences: whether notification, evidence preservation, customer communication or other obligations may apply.
• Likelihood of continuing harm: whether unauthorised access is still active, credentials remain exposed, malware is persistent or stolen information could be misused.

Low-severity breaches are generally limited in scope and have a contained effect. Examples might include a blocked phishing attempt, an isolated policy violation with no evidence of access to protected information, or a low-privilege account showing suspicious activity that has been stopped. These events still need to be recorded and investigated because apparently minor activity can be an early indication of a broader attack. The response may involve validating the alert, securing the account or device, checking relevant logs and monitoring for recurrence.

Moderate-severity breaches have a credible security impact but remain sufficiently contained for the business to manage without a major interruption. Examples could include confirmed unauthorised access to one user account, malware on a workstation with no evidence of wider movement, or limited exposure of internal information. The response normally requires formal incident ownership, scope assessment, credential resets, isolation or reimaging where appropriate, and a review of whether other accounts or systems were affected.

High-severity breaches indicate substantial risk to the organisation or to affected individuals. They may involve privileged access, confirmed theft of sensitive information, compromise of several connected systems, material disruption to important operations or evidence that the attacker has maintained access. At this level, technical containment should be coordinated with senior management and, where relevant, legal, privacy, communications and cyber insurance advisers. Decisions should be documented because actions such as disabling services, taking systems offline or notifying external parties can have significant consequences.

Critical-severity breaches involve an immediate and serious threat to the organisation’s ability to operate, its legal or regulatory position, or the confidentiality and integrity of highly sensitive information. Indicators may include extensive administrative compromise, destructive activity, widespread encryption or deletion, serious disruption across locations, or an inability to establish whether attackers still control core systems. A critical classification calls for executive oversight, a coordinated response structure, priority protection of essential services and careful preservation of evidence. Recovery should not begin by simply restoring systems without first addressing the route used by the attacker.

Organisations often use a severity matrix to make classifications more consistent. One axis can represent the potential harm, such as limited, material or severe, while another represents the likelihood that the harm will occur or continue. The resulting rating can then be mapped to response categories. This avoids treating a breach as low risk merely because its consequences have not yet become visible. A compromised account with unknown activity, for example, may initially receive a higher provisional rating until investigation establishes its actual scope.

Severity should be reviewed as facts develop. Initial triage is based on incomplete information, so a breach may be downgraded when investigation confirms that access was blocked and no protected information was reached. Conversely, it should be escalated when forensic evidence reveals privilege escalation, lateral movement, data transfer or persistence. Every change should include the reason, the evidence available at the time and the person who authorised the decision.

The classification also helps determine the appropriate response controls. Lower-level events may be handled through established operational procedures, whereas higher-level incidents generally require a named incident lead, a documented decision log, coordinated communications, forensic support and defined approval for containment and recovery actions. The classification should not prevent staff from escalating concerns: when in doubt, it is safer to use a provisional higher rating and reduce it after verification than to delay action while trying to achieve certainty.

Where personal data may be involved, severity assessment should be linked to the organisation’s data breach process. The business must establish what information was affected, whose information it was, the likely consequences and whether notification duties apply. In the UK, a personal data breach that is likely to result in a risk to individuals may need to be reported to the Information Commissioner’s Office within the applicable statutory period, and affected individuals may also need to be informed where the risk is high. That decision should be based on the facts of the breach and appropriate legal or privacy advice, not on the technical severity label alone.

A useful incident record should therefore capture the provisional classification, the evidence supporting it, affected assets and accounts, known and possible data exposure, business dependencies, containment decisions, required notifications, review points and the final classification. After resolution, the organisation can compare the initial rating with the confirmed findings and improve its thresholds, monitoring and incident response plan.