> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/getting-started/fundamentals/detect/detection-severity-framework.md).

# Detection Severity Framework

## **Material Detection Framework**

The Material detection framework aims to streamline cloud office security by identifying issues that are focused, meaningful, and actionable, ensuring your security team allocates time effectively.

### **Guiding Principles**

**Focused & Actionable**\
Material detections clearly outline risks and responses. Automated actions or API integrations facilitate immediate responses from the platform.

**Meaningful**\
Material Issues are intuitive and informative, providing clarity on what happened, why it matters, and recommended next steps.

**Severity Reflects True Risk**\
Severity considers business impact and likelihood of harm, not the volume or novelty of data. For instance, a verified compromise could be rated Critical, while frequent anomalies might be Low.

### Severity Scale and Definitions

<figure><img src="/files/h4oF4hlihjuUWDmVOdHn" alt=""><figcaption></figcaption></figure>

| Severity     | Definition                                                                                    |
| ------------ | --------------------------------------------------------------------------------------------- |
| **Critical** | Clear, ongoing compromise or data theft/destruction requiring immediate containment           |
| **High**     | Strong indicator of compromise or dangerous misconfiguration with near-term exploitation risk |
| **Medium**   | Credible risk needing investigation or hardening but not urgent in isolation                  |
| **Low**      | Contextual or noise signals valuable mainly for aggregation or correlation                    |
| **Info**     | Operational or hygiene event reflecting configuration or posture rather than threat           |

### How Material Determines and Assigns Severity to Detections

Material assesses each detection by evaluating multiple factors, ensuring accurate severity assignment. This process involves:

1. **Impact Analysis**: Understanding the potential consequences on systems or data if the issue isn't addressed promptly.
2. **Likelihood Evaluation**: Gauging how probable it is for the detected issue to be exploited or cause harm.
3. **Environmental Context**: Considering the specific environment where the detection occurred, including any mitigating factors.
4. **Historical Data**: Reviewing similar past incidents to gauge potential patterns or recurring threats.

These factors collectively inform the severity level assigned, helping prioritize responses and allocate resources efficiently.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.material.security/getting-started/fundamentals/detect/detection-severity-framework.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.