Free OWASP Risk Assessment Calculator
Estimate cybersecurity risk from the likelihood and impact factors you select. The result supports discussion and prioritisation; it is not an audit or a compliance certificate.
How to Use This Calculator
Follow these steps to evaluate cyber risk using the OWASP methodology:
- Define the threat scenario — Describe the specific threat or attack vector you want to evaluate, such as SQL injection, insider threat, or phishing attack.
- Rate the Likelihood factors — Score each threat agent factor (skill level, motive, opportunity, size) and vulnerability factor (ease of discovery, ease of exploit, awareness, intrusion detection) from 0 to 9.
- Rate the Impact factors — Score confidentiality, integrity, availability, financial damage and reputation damage from 0 to 9. These are the five impact factors implemented in this tool.
- Get your risk rating — Complete all 13 factors. The summary updates automatically when the selection is complete; no separate calculation button is needed.
- Export your results — Use Export for Excel (.csv) to download a CSV file, or copy the shareable link. The link includes the selected scores, so review it before sharing.
This calculator uses selected threat, vulnerability and impact factors inspired by the OWASP risk rating approach. The score depends on your inputs and assumptions; document them and review the result in your business context.
Use it as a starting point for an internal risk discussion, alongside evidence and professional judgement.
Free Interactive Assessment
Quantify technical and business cyber risk in minutes
Complete the factors below to generate a shareable risk profile, business-ready summary and an emailed copy of your result.
Live Result
Risk Assessment Summary
Select all 13 factors to calculate your final score.
Executive Summary
Finish the assessment to generate an executive-level summary and next-step guidance.
Recommended Next Actions
- Complete the calculator to unlock a tailored action plan.
Shareable Score Vector
Pending completionEmail This Assessment
Get this result in your inbox
Complete the assessment, then leave your details to receive an emailed copy of this result. MicroHackers will also be notified internally.
The calculator provides an indicative estimate. It does not scan systems, detect vulnerabilities or validate the information entered.
Using this tool does not demonstrate compliance with ISO/IEC 27005, NIST SP 800-30 or any other framework. A formal assessment requires a defined scope, evidence and an appropriate methodology.