The first time you use the Security Report Generator, you should use one of the standard severity mappings to understand how the report is calculated. Thereafter, you might want to create a custom severity mapping. Consider the context in which your application is used, and select the severity of each technical impact with regard to the likelihood of its having a damaging effect. Because it is difficult to estimate the likelihood of a particular weakness being activated, likelihood should not be considered when choosing the severity level.