---
title: "Rank findings by harm · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/rank-findings
updated: 2026-10-20
licence: "All rights reserved"
---

# Rank findings by harm

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Rules of engagement](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement)
- Rule: Give every finding a severity from how easy it is to use and how much harm it does. Fix the worst first.
- How: Use four levels. Critical means anyone can take data or control without logging in. High needs an account or one extra step. Medium needs unusual conditions. Low is a weakness without a known harm. A scoring system such as CVSS 4.0 can add detail.
- Check: Every finding has a severity, a proof, the harm in one sentence and a fix.

Example:

```markdown
## Finding 3: Any logged-in user can read other orders
- Severity: High
- Proof: GET /api/orders/1002 with the token of the user who owns order 1001 returns 200
- Harm: Any customer can read the name and address on every order
- Fix: Check that the order belongs to the logged-in user before returning it
- Retest: Same request now returns 404
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/rank-findings`.

- Previous: [Log every request](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/log-every-request)
- Next: [Turn every fix into a check](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/fix-becomes-check)
- [Rules of engagement](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement)