Breaking into foreign IT systems in the role of an attacker can be very captivating. As a penetration tester, however, you should never lose sight of the actual goal: identifying all entry points and vulnerabilities in a target system. The list of vulnerabilities can become very long and confusing. But in order to tell a customer which vulnerabilities should be addressed or fixed first, the identified vulnerabilities must be ordered according to their risk.
In principle, the risk of a vulnerability can be represented in two different ways. Either a concrete numeric value is determined (e.g. 1,034.99 euros) or a statement is made about the severity of the risk (such as low, medium, high). The concrete numeric value is the result of a quantitative risk analysis. This is suited, for example, to determining the risk of a hard disk failure, since hard disks have a concrete price and an average life expectancy. By contrast, a pentester usually does not have enough information of this kind available for IT system vulnerabilities, so this form of risk analysis is not advisable. A qualitative risk analysis, on the other hand, can be performed, since statements about the likelihood of occurrence and the possible extent of damage of a vulnerability can always be made, allowing the severity of the risk to be estimated. As with any estimate, different pentesters will arrive at different risk ratings because their perception and experience differ - even when they use the same rating scheme.
Regulatory bodies such as the Regierungspräsidium Darmstadt (Darmstadt Regional Council), however, require a uniform system, since they have to define concrete requirements and measures. Consequently, they demand that pentesters perform a risk rating according to the Common Vulnerability Scoring System (CVSS). This is a metric-based rating scheme that assigns a vulnerability a score between 0 and 10 - the higher the score, the more severe the risk of the vulnerability. Even though the CVSS calculates the risk of a vulnerability from a large number of parameters (see https://www.first.org/cvss/calculator/3.1), factors such as the impact of a successfully exploited vulnerability on integrity remain at the pentesters' discretion. Thus, risk figures such as the CVSS score can serve a customer as a guideline, but an internal assessment of the vulnerabilities should always be performed.