Security Research 101, Part 5: Describe Impact Without Guessing

A strong impact statement is the smallest real consequence your evidence supports. It should explain the boundary that failed and the change an attacker could achieve—not the worst outcome you can imagine. ## Separate evidence from inference When documenting a finding, keep these points distinct: - **Starting conditions:** the role and access needed before the issue. - **Observed behavior:** what you actually saw in the authorized test. - **Impact:** the data, action, or system boundary affected. - **Limits:** what your test did not establish. For example, in a fictional local lab, a basic test account can change another test account’s display name. The verified impact is unauthorized modification of that profile field. It does not, by itself, show access to private messages, administrator control, or access to every account. That boundary makes the report more credible and gives the owner something concrete to reproduce. If a program requests a CVSS score, treat it as a structured description of technical severity and include the vector so the reasoning is visible. FIRST’s CVSS v4.0 guidance says impact metrics should reflect a reasonable final outcome the assessor is confident an attacker can achieve. Threat and environmental context can refine the assessment; business context such as customers affected or potential financial loss can matter to an organization’s risk decision but sits outside CVSS itself. A score is useful context, not a substitute for explaining the evidence. Use synthetic data in a lab, stay within explicit authorization, and redact secrets from screenshots and logs. The previous lessons cover [bug versus vulnerability](https://www.mushimu.com/post/9177), [reading a request](https://www.mushimu.com/post/9178), [triaging scanner alerts](https://www.mushimu.com/post/9179), and [safe input fuzzing](https://www.mushimu.com/post/9182). Sources: [FIRST: CVSS v4.0 Specification](https://www.first.org/cvss/v4.0/specification-document) · [FIRST: CVSS v4.0 overview](https://www.first.org/cvss/v4.0/) ~cybersecurity