DREAD Risk Scoring: How It Works and Why It Fell Out of Favour

DREAD is a scoring model for ranking threats, originally paired with STRIDE at Microsoft. STRIDE identifies what could go wrong; DREAD ranks what to fix first. It is worth knowing both because it still appears on exams and because the reasons it was abandoned teach something about risk scoring generally.

The five categories

Each is rated on a scale — commonly 1 to 10, sometimes 1 to 3 — and the ratings are combined.

Damage — how bad is the outcome if this is exploited? Data destruction or full system compromise scores high; minor information disclosure scores low.

Reproducibility — how reliably does the attack work? Something that works every time scores high; something requiring a narrow race condition scores low.

Exploitability — how much skill, time and access does it take? A single unauthenticated request scores high; a chain requiring physical access and custom tooling scores low.

Affected users — what proportion of users or systems are exposed? All users scores high; one administrator on one host scores low.

Discoverability — how easily is the flaw found? Visible in the interface scores high; requiring source code review scores low.

Scores are averaged or summed into one number, and findings are ranked by it.

A worked example

An unauthenticated SQL injection in a public login form. Damage is high — the database is exposed. Reproducibility is high — it works on every attempt. Exploitability is high — automated tools do it. Affected users is high — every record in the database. Discoverability is high — a scanner finds it in minutes. Total score near maximum, and the ranking is obviously correct.

Compare a privilege escalation requiring an existing low-privileged account and a specific timing window. Damage high, reproducibility moderate, exploitability low, affected users moderate, discoverability low. A middling score, and again the ranking is intuitively reasonable.

The model works well when the answers are clear. The trouble starts when they are not.

Why it was abandoned

Subjectivity. There is no definition of what makes damage a 7 rather than a 5. Two competent assessors score the same finding differently, and the same assessor scores differently on different days. A model whose output depends on who ran it does not support consistent prioritization.

Discoverability is the wrong question. Scoring a flaw lower because it is hard to find rewards obscurity, which is not a security property. An undiscovered flaw is not a less severe flaw — it is a flaw with an unknown clock on it. Many teams simply dropped the category, which tells you something.

Averaging hides the extremes. A finding with catastrophic damage and low exploitability averages to the same place as one with moderate damage and moderate everything — and they are not equivalent decisions.

No business context. The same technical flaw on a payment system and a staff noticeboard scores identically, which is exactly the distinction prioritization needs to make.

Microsoft moved away from it, and it survives mainly in coursework and in teams that value a simple shared vocabulary over precision.

What is used instead

CVSS provides a defined, documented scoring method with metrics for attack vector, complexity, privileges required, user interaction, scope and impact. Its base score is comparable across organizations, and its environmental and temporal metrics exist to add your context — which most teams ignore, then complain that CVSS lacks context.

Exploitability data is the bigger improvement. Whether a vulnerability is actually being exploited in the wild matters more than how theoretically severe it is, which is the argument behind EPSS scoring and known-exploited catalogs. A medium-severity flaw under active attack outranks a high-severity one nobody has ever used.

Business impact supplies what neither provides: which asset, whose data, what it would cost. Asset-driven methods such as OCTAVE start there deliberately, and pairing a technical score with asset criticality from a maintained inventory is what makes a prioritized list defensible.

Where DREAD still has value is as a structured conversation. Walking a team through five named dimensions produces better reasoning than "this one feels worse," even if the resulting number should not be treated as precise.

Exam angles

Know DREAD as Damage, Reproducibility, Exploitability, Affected users, Discoverability, used to rank threats identified by STRIDE. Be able to explain its limitations — subjectivity, discoverability rewarding obscurity, averaging masking extremes, and no business context — and name CVSS with exploitability data and asset criticality as the modern approach to prioritisation.