[hef19898]

Sometimes one has to include detectability as well.

[datadrivenangel]

Severity should include detectability. If you never detect an issue, it's not an issue because nobody sees it.

[hef19898]

Usually it is a seperate factor, at least as far as P/D-MEAs are concerned. Quick and dirty, sure, it can be included in severity. Personally, I prefer the increased transparency and granularity of having detectability as a different factor.

[HL33tibCe7]

To me, that’s a subcomponent of severity