A penetration test lands in your inbox with 80 findings. Nearly all of them are marked high. Your team has time to fix maybe ten before the next release. So which ten? Without a way to rank them, everything looks urgent and the genuinely dangerous issues get lost in the pile.
This is the problem DREAD scoring solves. It takes a vague sense that a vulnerability feels serious and turns it into a number you can sort by. This guide explains how DREAD works, scores a real mobile finding out of 50, and shows when it beats CVSS for triaging app issues.
It is written for security engineers, triage teams, and CISOs who need to prioritise mobile app vulnerabilities with something better than gut feel.
What is DREAD scoring?
DREAD is a risk scoring model, originally developed at Microsoft, that rates a vulnerability across five dimensions. You score each one from 0 to 10 and add them up, giving a total out of 50. The higher the number, the higher the priority.
Its strength is simplicity. Five questions, one number, a backlog you can rank in minutes. That suits mobile app triage well, where a single test can surface dozens of findings that all need ordering.
The five DREAD dimensions
DREAD is an acronym. Each letter is a question you ask about the vulnerability.
- Damage potential. How bad is it if someone exploits this?
- Reproducibility. How reliably can the attack be repeated?
- Exploitability. How much skill and effort does it take to pull off?
- Affected users. How many of your users does it put at risk?
- Discoverability. How easily can an attacker find the flaw in the first place?
Score each from 0 to 10, where 0 is negligible and 10 is severe.
A worked example: scoring a hardcoded key out of 50
Theory is cheap, so here is a real one. Among the common mobile app vulnerabilities, a hardcoded key is one of the most frequent and most damaging. Say a scan finds an encryption key written directly into the app’s code. Here is how DREAD scores it.
| Dimension | Score | Why this score |
| Damage potential | 8 | A leaked encryption or backend key can expose data and let an attacker impersonate the app |
| Reproducibility | 10 | The key is identical in every copy of the app and works the same way every time |
| Exploitability | 9 | Pulling a string from an APK takes minutes with free tools and no special skill |
| Affected users | 9 | The key ships in every install, so most or all users are exposed |
| Discoverability | 9 | Anyone can download the app from the store and search the package for secrets |
| Total | 45 / 50 | Critical. Fix before the next release and rotate the key |
That total lands firmly in critical territory. This is not finding your schedule for next quarter. It gets fixed before the next release, and the key gets rotated.
How to read a DREAD score
The total only helps if everyone agrees what the number means. Most teams set bands once and apply them consistently. A common split looks like this.
- 0 to 12, low
- 13 to 25, medium
- 26 to 38, high
- 39 to 50, critical
Pick your thresholds, write them down, and use the same ones every time. The exact bands matter less than applying them consistently.
DREAD vs CVSS, and when DREAD wins for mobile
The most common objection to DREAD is that CVSS already exists. CVSS is the industry standard for scoring vulnerabilities, and for known CVEs it is the right tool. If a scan flags an outdated library with a published CVE, use the CVSS score that comes with it.
DREAD earns its place elsewhere. Many mobile pentest findings are not CVEs. A hardcoded key, sensitive data in logs, or a missing certificate pinning check has no neat CVSS vector, and forcing one is awkward. DREAD handles these cleanly, and it weighs factors that matter for mobile, like how many users are affected and how easily an attacker can pull your APK from the store and dig through it.
DREAD has a real weakness worth naming. It is subjective, so two engineers can score the same issue differently. The fix is a short rubric that defines what a 3 or an 8 means for each dimension, which keeps scoring consistent across the team. Used that way, DREAD and CVSS are not rivals. CVSS handles your dependency CVEs, DREAD ranks your app specific findings, and together they give a triage team the full picture. That pairing is one of the quieter mobile app security best practices that separates a tidy backlog from a chaotic one.