Most SOCs argue about severity mid-incident. A good incident severity matrix ends the argument: three questions, one number, one priority, and a matching response target. Here is the blast-radius score we use, with worked examples you can copy.
Tool severities describe the alert, not the incident. A "high" EDR alert on a test VM matters less than a "medium" sign-in alert on a domain admin. Priority should combine what is at stake, how sure you are, and how far it has spread.
Score each question from 1 to 3 and multiply. The result runs from 1 to 27.
| Question | 1 | 2 | 3 |
|---|---|---|---|
| Criticality | Standard user/asset | Sensitive data or service | Admin, DC, crown jewel, OT |
| Confidence | Weak signal / single alert | Corroborated by 2+ sources | Confirmed malicious |
| Spread | One entity | Several entities | Domain/tenant-wide or exfil |
| Priority | Score | Response |
|---|---|---|
| P1 Critical | 18-27 | Respond now, war room, leadership informed |
| P2 High | 9-17 | Respond within 1 hour, Tier 2/3 |
| P3 Medium | 4-8 | Same business day, Tier 1/2 |
| P4 Low | 1-3 | Queue, document, tune |
Set a response target for each priority and track it. Example targets (tune them to your team): P1 within 15 minutes, P2 within 1 hour, P3 within 8 hours, P4 within 2 days.
| Scenario | C × C × S | Score | Priority |
|---|---|---|---|
| Confirmed phishing email reported, nobody clicked | 1 × 3 × 1 | 3 | P4 |
| Malware alert on a finance laptop, confirmed by sandbox | 2 × 3 × 1 | 6 | P3, climb if it spreads |
| Suspicious PowerShell on 4 servers, 2 tools agree | 2 × 2 × 2 | 8 | P3, re-score hourly |
| Confirmed credential theft on an admin account, used on several hosts | 3 × 3 × 2 | 18 | P1 |
| Suspicious activity involving a domain controller | n/a | n/a | P1 (override) |
Re-score whenever confidence or spread changes. Priority is a living number, not a label you set once.
Use the priority to pick a rung on the containment ladder: P4 → watch, P3 → restrict, P2 → isolate, P1 → revoke or disable (and rebuild where needed). For a user account, that looks like this:
In the SOC IR Navigator, Start incident asks the three questions, applies the overrides, sets P1–P4, starts a live countdown to your response target and suggests the containment rung. Every step you tick is timestamped for the report.
Get the SOC IR NavigatorWatch the 2-minute demoSeverity usually describes impact; priority decides the order of work and the response time. The blast-radius score combines impact (criticality and spread) with confidence, so it gives you priority directly.
Tier 1 sets an initial score during triage. The IR lead confirms or changes it when the incident is escalated, and anyone can raise it when new evidence appears.
Yes. Keep the three questions and split the score bands into five. What matters is that everyone scores the same way.
NIST SP 800-61r3 asks organisations to prioritise incidents based on impact and risk. The matrix is one practical way to do that consistently. See the incident response playbook guide for the full process.
Educational guidance only. Adapt every step to your environment, policies and legal obligations. MITRE ATT&CK® is a registered trademark of The MITRE Corporation; technique IDs reference ATT&CK v20. NIST does not endorse any commercial product.