Security
Two medium findings are not two medium findings
Severity scored per finding tells you about findings. Attackers are not interested in findings; they are interested in paths.
A permissive redirect is a medium. A cookie scoped one level too broadly is a medium. Put them in the same system and they are a session fixation attack against a real user, which is not a medium.
Scoring in isolation is the default
Most testing scores each finding against a generic rubric, in isolation, because that is what the rubric is for and what tooling produces. The result is a report ordered by a number that describes the finding rather than your system.
It also produces reports that look reassuring. Nothing critical, several mediums, remediate at your convenience - which is a fair description of a great many systems shortly before an incident.
Ask for the path
- What can be reached from the outside with no credentials?
- What does clearing each boundary make reachable next?
- Which two findings, together, cross a boundary that neither crosses alone?
A finding only matters in terms of what it lets someone reach next.
The change is mostly one of framing, and it is not more expensive. It does require a tester who is willing to spend time on something a scanner cannot produce, and a report that is written rather than generated.