The environmental score customizes the [severity](severity.html) of a vulnerability to an asset specific to the program’s organization. Setting this score enables you to see how severe the vulnerability to an asset is to your organization. It’s determined by setting impact levels to these 3 metrics:

<i>You can read more on these metrics in the section below on <b>Environmental Score Components</b>.</i>

There are cases where the CVSS rating on HackerOne is vastly different from the CVSS calculator on [first.org](https://www.first.org/cvss/calculator/3.0). The discrepancy in severity ratings isn’t a bug!

The CVSS calculator on first.org gives 3 different scores. The different scores are the:

* Base score

* Temporal score

* Environmental score

The CVSS score on HackerOne will be different from the CVSS scores on first.org because the score on HackerOne factors in <b>BOTH the environmental score and the base score</b> of the asset, whereas the scores on first.org are all separate.

<i>For example, you may find that the severity score for an asset on HackerOne is 4.3, whereas the base score on first.org is 5.4 and the environmental score is 5.4. The score on HackerOne is different because the environmental score is calculated into the base score, whereas on first.org, the environmental score is listed separately from the base score.</i>

HackerOne doesn’t randomly put the environmental score and the base score together to get a total CVSS rating. Whatever value is selected for each metric of the environmental score (confidentiality, integrity, availability), a numeric modifier is applied to that metric in the CVSS calculator. (<i>Note: The CVSS calculator also contains metrics from the environmental score.</i>)

<i>For example, when calculating your environmental score for the asset `test.com`, you set the confidentiality to be High. When either you or a hacker calculate the severity using the CVSS calculator on HackerOne, the 1.5 modifier for the Confidentiality metric is applied to the Confidentiality component in the CVSS calculator, which will give you a different score from the base score on first.org.</i>

The following table shows what modifier is applied. The same table is used for all 3 metrics. Note that choosing a metric value of Medium or not choosing any value at all will have no effect on the base score.

Metric Value | Modifier Value | Details

------------ | -------------- | --------

High | 1.5 | Loss of Confidentiality/Integrity/Availability is likely to have a catastrophic, adverse effect on the organization or individuals associated with the organization.

Medium | 1 | Loss of Confidentiality/Integrity/Availability is likely to have a serious adverse effect on the organization or individuals associated with the organization.

Low | 0.5 | Loss of Confidentiality/Integrity/Availability is likely to have only a limited adverse effect on the organization or individuals associated with the organization.

None | 0 | Loss of Confidentiality/Integrity/Availability is likely to have no adverse effect on the organization or individuals associated with organization.

Setting an environmental score for an asset also caps the CVSS severity rating when a hacker calculates the severity for the asset in the submission report. The maximum severity a hacker can set for the asset is shown in the <b>Maximum severity</b> field.