PRIORITIZE WHAT TO REVIEW
How severity
works.
A transparent score built from the evidence Verity recorded.
A review priority, not a verdict.
Verity adds and subtracts risk factors to produce a score from 0 to 100. The score helps order incidents for review. It is not the probability that a file is malware, and it does not certify that a low-scoring change is safe.
Risk factors and weights.
Each factor is counted once per incident. The combined score is clamped between 0 and 100. Negative values reflect evidence that can reduce risk; they do not make an incident disappear.
| Recorded evidence | Weight |
|---|---|
| New executable in a protected executable directory | +30 |
| Executable confirmed unsigned or ad hoc signed | +25 |
| Shell startup file modified | +20 |
| Reference to an automatically executed program added | +35 |
| LaunchAgent or LaunchDaemon persistence changed | +25 |
| Change in a privileged path | +20 |
| Permissions became more permissive | +15 |
| Recognized package-store symlink changed | +10 |
| Installer or package-manager process found in the ancestry | +15 |
| Apple platform signature | −30 |
| Executable explicitly trusted by the user | −20 |
| Previously observed Developer ID signer and update pattern | −15 |
| Expected package-manager activity with complete attribution | −20 |
Examples.
/opt/homebrew/bin/downloadSEV 30 · LowA newly created executable contributes 30 points. If Verity cannot establish its signing status, it does not assume the additional unsigned factor.
Unsigned executableSEV 55 · MediumA new protected executable (+30) that is confirmed unsigned (+25) totals 55.
~/.zshrc → downloadSEV 55+ · Medium or HighA shell startup change (+20) that adds automatic execution (+35) reaches 55 before any executable, permission, or path factors are added.
Expected package managerScore reduced by 20With complete process attribution and no persistence or privilege factors, recognized package-manager activity can lower the result.
Severity, notifications, and Protect.
These are related, but they answer different questions. Severity orders recorded incidents. Notifications call attention to actionable changes. Medium and High incidents notify, and some sensitive Low incidents notify as well—including a new executable created directly in a protected executable directory and changes to shell startup, SSH, or launch-item files.
Protect makes execution decisions for executables within its enabled scope. It can ask before a program runs even though file monitoring and severity scoring are separate. A notification reports recorded activity; it does not by itself mean an execution was blocked.
Back to the FAQ