> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.beaglesecurity.com/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Choosing your test score system: OWASP vs CVSS

Beagle Security allows you to choose how vulnerabilities are scored and prioritized across your security tests. You can set your preferred scoring system from the platform settings and switch between OWASP and CVSS based on your organization’s requirements.

**To choose or change your scoring system:**

* Click on the **Settings** icon, located right next to the profile icon.

* Select **Test settings.**

* Under **Test score system**, choose either **OWASP** or **CVSS**.

![](https://storage.crisp.chat/users/helpdesk/website/-/f/6/7/c/f67cd8fc6fde8000/9111xshotsso_mzulry.png)
# Understanding the testing scores
### OWASP
OWASP (Open Worldwide Application Security Project) groups findings according to the OWASP Top 10, a widely used framework for identifying common web application security risks.

**Choose OWASP if:**

* Your primary focus is web application security.

* Your team uses the OWASP Top 10 as a security reference.

* You want findings organized by vulnerability category rather than numerical severity scores.

* Developers and application teams are the primary audience for the results.

### CVSS
CVSS (Common Vulnerability Scoring System) assigns standardized severity scores to vulnerabilities based on factors such as exploitability and impact.

**Choose CVSS if:**

* Your organization uses severity-based vulnerability management.

* You need standardized risk scoring across multiple security tools.

* Security teams use numerical severity ratings to prioritize remediation.

# Which one should you choose?
For most teams focused on improving web application security, OWASP provides a familiar way to understand and prioritize findings.

If your organization uses formal vulnerability management processes or requires standardized severity ratings for reporting and compliance, CVSS is usually the better choice

# Understanding risk calculations
OWASP and CVSS use different methodologies to assess risk. As a result, the same finding may receive different scores or severity levels depending on the scoring system selected.

If you’d like to understand how each scoring system works, you can use the following calculators:

* [OWASP Risk Calculator](https://beaglesecurity.com/owasp-risk-calculator?)

* [CVSS Risk Calculator](https://beaglesecurity.com/cvss4-risk-calculator?vector=AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N)

These calculators allow you to experiment with different risk factors and see how they affect the resulting score or risk level.

|| Important note: Changing the score system does not affect how Beagle Security tests your application. It only changes how findings are categorized and prioritized in the platform. However, it is recommended to choose the scoring system that best aligns with your team’s workflow. Switching between scoring systems frequently can make it more difficult to compare results, track trends and measure improvements over time.