Repository: aquasecurity/tfsec
Pull request #858 (2021-07-13 09:31:37)

Rewrite the checks severities


Patch:
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 65879a7f1..6fbf7c3ea 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -130,7 +130,7 @@ CheckFunc: func(set result.Set, block *parser.Block, _ *hclcontext.Context) {
 						WithDescription(fmt.Sprintf("The Gibson '%s' is configured to be hackable.", block.Name())).
 						WithRange(attr.Range()).
 						WithAttributeAnnotation(attr).
-						WithSeverity(SeverityWarning),
+						,
 					)
                 }
             }
diff --git a/Makefile b/Makefile
index 96ab112ce..2bfe54af0 100644
--- a/Makefile
+++ b/Makefile
@@ -6,7 +6,7 @@ image:
 
 .PHONY: test
 test:
-	go test -mod=vendor -v ./...
+	go test -mod=vendor ./...
 
 .PHONY: build
 build:
diff --git a/internal/app/tfsec/custom/processing.go b/internal/app/tfsec/custom/processing.go
index 910e8d1fb..6e3901fa1 100644
--- a/internal/app/tfsec/custom/processing.go
+++ b/internal/app/tfsec/custom/processing.go
@@ -140,8 +140,7 @@ func processFoundChecks(checks ChecksFile) {
 						set.Add(
 							result.New(rootBlock).
 								WithDescription(fmt.Sprintf("Custom check failed for resource %s. %s", rootBlock.FullName(), customCheck.ErrorMessage)).
-								WithRange(rootBlock.Range()).
-								WithSeverity(customCheck.Severity),
+								WithRange(rootBlock.Range()),
 						)
 					}
 				},
diff --git a/internal/app/tfsec/funcs/cidr.go b/internal/app/tfsec/funcs/cidr.go
index c0c2b73c8..5f1504c0a 100644
--- a/internal/app/tfsec/funcs/cidr.go
+++ b/internal/app/tfsec/funcs/cidr.go
@@ -12,7 +12,7 @@ import (
 	"github.com/zclconf/go-cty/cty/gocty"
 )
 
-// CidrHostFunc contructs a function that calculates a full host IP address
+// CidrHostFunc constructs a function that calculates a full host IP address
 // within a given IP network address prefix.
 var CidrHostFunc = function.New(&function.Spec{
 	Params: []function.Parameter{
@@ -45,7 +45,7 @@ var CidrHostFunc = function.New(&function.Spec{
 	},
 })
 
-// CidrNetmaskFunc contructs a function that converts an IPv4 address prefix given
+// CidrNetmaskFunc constructs a function that converts an IPv4 address prefix given
 // in CIDR notation into a subnet mask address.
 var CidrNetmaskFunc = function.New(&function.Spec{
 	Params: []function.Parameter{
@@ -65,7 +65,7 @@ var CidrNetmaskFunc = function.New(&function.Spec{
 	},
 })
 
-// CidrSubnetFunc contructs a function that calculates a subnet address within
+// CidrSubnetFunc constructs a function that calculates a subnet address within
 // a given IP network address prefix.
 var CidrSubnetFunc = function.New(&function.Spec{
 	Params: []function.Parameter{
diff --git a/internal/app/tfsec/funcs/crypto.go b/internal/app/tfsec/funcs/crypto.go
index f888be26f..fe230e5bc 100644
--- a/internal/app/tfsec/funcs/crypto.go
+++ b/internal/app/tfsec/funcs/crypto.go
@@ -165,7 +165,7 @@ var RsaDecryptFunc = function.New(&function.Spec{
 			case asn1.SyntaxError:
 				errStr = strings.ReplaceAll(e.Error(), "asn1: syntax error", "invalid ASN1 data in the given private key")
 			case asn1.StructuralError:
-				errStr = strings.ReplaceAll(e.Error(), "asn1: struture error", "invalid ASN1 data in the given private key")
+				errStr = strings.ReplaceAll(e.Error(), "asn1: structure error", "invalid ASN1 data in the given private key")
 			default:
 				errStr = fmt.Sprintf("invalid private key: %s", e)
 			}
@@ -185,7 +185,7 @@ var RsaDecryptFunc = function.New(&function.Spec{
 	},
 })
 
-// Sha1Func contructs a function that computes the SHA1 hash of a given string
+// Sha1Func constructs a function that computes the SHA1 hash of a given string
 // and encodes it with hexadecimal digits.
 var Sha1Func = makeStringHashFunction(sha1.New, hex.EncodeToString)
 
@@ -195,7 +195,7 @@ func MakeFileSha1Func(baseDir string) function.Function {
 	return makeFileHashFunction(baseDir, sha1.New, hex.EncodeToString)
 }
 
-// Sha256Func contructs a function that computes the SHA256 hash of a given string
+// Sha256Func constructs a function that computes the SHA256 hash of a given string
 // and encodes it with hexadecimal digits.
 var Sha256Func = makeStringHashFunction(sha256.New, hex.EncodeToString)
 
@@ -205,7 +205,7 @@ func MakeFileSha256Func(baseDir string) function.Function {
 	return makeFileHashFunction(baseDir, sha256.New, hex.EncodeToString)
 }
 
-// Sha512Func contructs a function that computes the SHA512 hash of a given string
+// Sha512Func constructs a function that computes the SHA512 hash of a given string
 // and encodes it with hexadecimal digits.
 var Sha512Func = makeStringHashFunction(sha512.New, hex.EncodeToString)
 
diff --git a/internal/app/tfsec/funcs/number.go b/internal/app/tfsec/funcs/number.go
index b45677f00..6c8f5dc3b 100644
--- a/internal/app/tfsec/funcs/number.go
+++ b/internal/app/tfsec/funcs/number.go
@@ -10,7 +10,7 @@ import (
 	"github.com/zclconf/go-cty/cty/gocty"
 )
 
-// LogFunc contructs a function that returns the logarithm of a given number in a given base.
+// LogFunc constructs a function that returns the logarithm of a given number in a given base.
 var LogFunc = function.New(&function.Spec{
 	Params: []function.Parameter{
 		{
@@ -38,7 +38,7 @@ var LogFunc = function.New(&function.Spec{
 	},
 })
 
-// PowFunc contructs a function that returns the logarithm of a given number in a given base.
+// PowFunc constructs a function that returns the logarithm of a given number in a given base.
 var PowFunc = function.New(&function.Spec{
 	Params: []function.Parameter{
 		{
@@ -66,7 +66,7 @@ var PowFunc = function.New(&function.Spec{
 	},
 })
 
-// SignumFunc contructs a function that returns the closest whole number greater
+// SignumFunc constructs a function that returns the closest whole number greater
 // than or equal to the given value.
 var SignumFunc = function.New(&function.Spec{
 	Params: []function.Parameter{
@@ -92,7 +92,7 @@ var SignumFunc = function.New(&function.Spec{
 	},
 })
 
-// ParseIntFunc contructs a function that parses a string argument and returns an integer of the specified base.
+// ParseIntFunc constructs a function that parses a string argument and returns an integer of the specified base.
 var ParseIntFunc = function.New(&function.Spec{
 	Params: []function.Parameter{
 		{
diff --git a/internal/app/tfsec/rules/aws001.go b/internal/app/tfsec/rules/aws001.go
index 5c8f5213c..542962b5f 100644
--- a/internal/app/tfsec/rules/aws001.go
+++ b/internal/app/tfsec/rules/aws001.go
@@ -57,7 +57,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_s3_bucket"},
-		DefaultSeverity: severity.Medium,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			if attr := resourceBlock.GetAttribute("acl"); attr != nil {
 				if attr.IsAny("public-read", "public-read-write", "website") {
@@ -65,15 +65,13 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' has an ACL which allows public access.", resourceBlock.FullName())).
 							WithAttributeAnnotation(attr).
-							WithRange(attr.Range()).
-							WithSeverity(severity.Medium),
+							WithRange(attr.Range()),
 					)
 				} else if attr.Equals("authenticated-read") {
 					set.Add(
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' has an ACL which allows access to any authenticated AWS user, not just users within the target account.", resourceBlock.FullName())).
-							WithRange(attr.Range()).
-							WithSeverity(severity.Medium),
+							WithRange(attr.Range()),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws002.go b/internal/app/tfsec/rules/aws002.go
index 80e9da12e..1923ed2ce 100644
--- a/internal/app/tfsec/rules/aws002.go
+++ b/internal/app/tfsec/rules/aws002.go
@@ -55,7 +55,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_s3_bucket"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			if loggingBlock := resourceBlock.GetBlock("logging"); loggingBlock == nil {
 				if resourceBlock.GetAttribute("acl") != nil && resourceBlock.GetAttribute("acl").Equals("log-delivery-write") {
@@ -64,8 +64,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not have logging enabled.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws003.go b/internal/app/tfsec/rules/aws003.go
index 028361363..cfebca091 100644
--- a/internal/app/tfsec/rules/aws003.go
+++ b/internal/app/tfsec/rules/aws003.go
@@ -53,13 +53,12 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_db_security_group", "aws_redshift_security_group", "aws_elasticache_security_group"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			set.Add(
 				result.New(resourceBlock).
 					WithDescription(fmt.Sprintf("Resource '%s' uses EC2 Classic. Use a VPC instead.", resourceBlock.FullName())).
-					WithRange(resourceBlock.Range()).
-					WithSeverity(severity.High),
+					WithRange(resourceBlock.Range()),
 			)
 		},
 	})
diff --git a/internal/app/tfsec/rules/aws004.go b/internal/app/tfsec/rules/aws004.go
index 9c02e1325..36a5f00d2 100644
--- a/internal/app/tfsec/rules/aws004.go
+++ b/internal/app/tfsec/rules/aws004.go
@@ -56,7 +56,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_lb_listener", "aws_alb_listener"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, ctx *hclcontext.Context) {
 			// didn't find the referenced block, log and move on
 			if checkIfExempt(resourceBlock, ctx) {
@@ -82,7 +82,6 @@ func init() {
 
 			res := result.New(resourceBlock).
 				WithDescription(fmt.Sprintf("Resource '%s' uses plain HTTP instead of HTTPS.", resourceBlock.FullName())).
-				WithSeverity(severity.High).
 				WithRange(resourceBlock.Range())
 
 			if protocolAttr != nil {
diff --git a/internal/app/tfsec/rules/aws005.go b/internal/app/tfsec/rules/aws005.go
index 9bbd2f1e2..f62513c34 100644
--- a/internal/app/tfsec/rules/aws005.go
+++ b/internal/app/tfsec/rules/aws005.go
@@ -54,7 +54,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_alb", "aws_elb", "aws_lb"},
-		DefaultSeverity: severity.Medium,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			if resourceBlock.HasChild("load_balancer_type") && resourceBlock.GetAttribute("load_balancer_type").Equals("gateway") {
 				return
@@ -63,16 +63,14 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' is exposed publicly.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Medium),
+						WithRange(resourceBlock.Range()),
 				)
 			} else if internalAttr.Type() == cty.Bool && internalAttr.Value().False() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' is exposed publicly.", resourceBlock.FullName())).
 						WithRange(internalAttr.Range()).
-						WithAttributeAnnotation(internalAttr).
-						WithSeverity(severity.Medium),
+						WithAttributeAnnotation(internalAttr),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws006.go b/internal/app/tfsec/rules/aws006.go
index 98332409b..2a44ce139 100644
--- a/internal/app/tfsec/rules/aws006.go
+++ b/internal/app/tfsec/rules/aws006.go
@@ -56,7 +56,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_security_group_rule"},
-		DefaultSeverity: severity.Medium,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			typeAttr := resourceBlock.GetAttribute("type")
@@ -74,8 +74,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' defines a fully open ingress security group rule.", resourceBlock.FullName())).
 							WithAttributeAnnotation(cidrBlocksAttr).
-							WithRange(cidrBlocksAttr.Range()).
-							WithSeverity(severity.Medium),
+							WithRange(cidrBlocksAttr.Range()),
 					)
 				}
 			}
@@ -86,8 +85,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' defines a fully open ingress security group rule.", resourceBlock.FullName())).
 							WithRange(ipv6CidrBlocksAttr.Range()).
-							WithAttributeAnnotation(ipv6CidrBlocksAttr).
-							WithSeverity(severity.Medium),
+							WithAttributeAnnotation(ipv6CidrBlocksAttr),
 					)
 				}
 
diff --git a/internal/app/tfsec/rules/aws007.go b/internal/app/tfsec/rules/aws007.go
index a6959dbfd..ad6af3141 100644
--- a/internal/app/tfsec/rules/aws007.go
+++ b/internal/app/tfsec/rules/aws007.go
@@ -56,7 +56,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_security_group_rule"},
-		DefaultSeverity: severity.Medium,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			typeAttr := resourceBlock.GetAttribute("type")
@@ -75,8 +75,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' defines a fully open egress security group rule.", resourceBlock.FullName())).
 							WithRange(cidrBlocksAttr.Range()).
-							WithAttributeAnnotation(cidrBlocksAttr).
-							WithSeverity(severity.Medium),
+							WithAttributeAnnotation(cidrBlocksAttr),
 					)
 				}
 			}
@@ -88,8 +87,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' defines a fully open egress security group rule.", resourceBlock.FullName())).
 							WithRange(ipv6CidrBlocksAttr.Range()).
-							WithAttributeAnnotation(ipv6CidrBlocksAttr).
-							WithSeverity(severity.Medium),
+							WithAttributeAnnotation(ipv6CidrBlocksAttr),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws008.go b/internal/app/tfsec/rules/aws008.go
index 12ed9f1fd..9f03f336d 100644
--- a/internal/app/tfsec/rules/aws008.go
+++ b/internal/app/tfsec/rules/aws008.go
@@ -56,7 +56,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_security_group"},
-		DefaultSeverity: severity.Medium,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(resultSet result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			for _, directionBlock := range resourceBlock.GetBlocks("ingress") {
@@ -67,8 +67,7 @@ func init() {
 							result.New(resourceBlock).
 								WithDescription(fmt.Sprintf("Resource '%s' defines a fully open ingress security group.", resourceBlock.FullName())).
 								WithRange(cidrBlocksAttr.Range()).
-								WithAttributeAnnotation(cidrBlocksAttr).
-								WithSeverity(severity.Medium),
+								WithAttributeAnnotation(cidrBlocksAttr),
 						)
 					}
 				}
@@ -79,8 +78,7 @@ func init() {
 						resultSet.Add(
 							result.New(resourceBlock).
 								WithDescription(fmt.Sprintf("Resource '%s' defines a fully open ingress security group.", resourceBlock.FullName())).
-								WithRange(cidrBlocksAttr.Range()).
-								WithSeverity(severity.Medium),
+								WithRange(cidrBlocksAttr.Range()),
 						)
 					}
 				}
diff --git a/internal/app/tfsec/rules/aws009.go b/internal/app/tfsec/rules/aws009.go
index 9af82d6f5..fa5f17f69 100644
--- a/internal/app/tfsec/rules/aws009.go
+++ b/internal/app/tfsec/rules/aws009.go
@@ -56,7 +56,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_security_group"},
-		DefaultSeverity: severity.Medium,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			for _, directionBlock := range resourceBlock.GetBlocks("egress") {
@@ -67,8 +67,7 @@ func init() {
 							result.New(resourceBlock).
 								WithDescription(fmt.Sprintf("Resource '%s' defines a fully open egress security group.", resourceBlock.FullName())).
 								WithRange(cidrBlocksAttr.Range()).
-								WithAttributeAnnotation(cidrBlocksAttr).
-								WithSeverity(severity.Medium),
+								WithAttributeAnnotation(cidrBlocksAttr),
 						)
 					}
 				}
@@ -80,8 +79,7 @@ func init() {
 							result.New(resourceBlock).
 								WithDescription(fmt.Sprintf("Resource '%s' defines a fully open egress security group.", resourceBlock.FullName())).
 								WithRange(cidrBlocksAttr.Range()).
-								WithAttributeAnnotation(cidrBlocksAttr).
-								WithSeverity(severity.Medium),
+								WithAttributeAnnotation(cidrBlocksAttr),
 						)
 					}
 				}
diff --git a/internal/app/tfsec/rules/aws010.go b/internal/app/tfsec/rules/aws010.go
index 12fa111ef..c3a570a3a 100644
--- a/internal/app/tfsec/rules/aws010.go
+++ b/internal/app/tfsec/rules/aws010.go
@@ -63,7 +63,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_lb_listener", "aws_alb_listener"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if sslPolicyAttr := resourceBlock.GetAttribute("ssl_policy"); sslPolicyAttr != nil && sslPolicyAttr.Type() == cty.String {
@@ -73,8 +73,7 @@ func init() {
 							result.New(resourceBlock).
 								WithDescription(fmt.Sprintf("Resource '%s' is using an outdated SSL policy.", resourceBlock.FullName())).
 								WithRange(sslPolicyAttr.Range()).
-								WithAttributeAnnotation(sslPolicyAttr).
-								WithSeverity(severity.High),
+								WithAttributeAnnotation(sslPolicyAttr),
 						)
 					}
 				}
diff --git a/internal/app/tfsec/rules/aws011.go b/internal/app/tfsec/rules/aws011.go
index d1dee51ed..9e51bf98f 100644
--- a/internal/app/tfsec/rules/aws011.go
+++ b/internal/app/tfsec/rules/aws011.go
@@ -22,7 +22,7 @@ import (
 const AWSPubliclyAccessibleResource = "AWS011"
 const AWSPubliclyAccessibleResourceDescription = "A database resource is marked as publicly accessible."
 const AWSPubliclyAccessibleResourceImpact = "The database instance is publicly accessible"
-const AWSPubliclyAccessibleResourceResolution = "Set the database to not be publically accessible"
+const AWSPubliclyAccessibleResourceResolution = "Set the database to not be publicly accessible"
 const AWSPubliclyAccessibleResourceExplanation = `
 Database resources should not publicly available. You should limit all access to the minimum that is required for your application to function. 
 `
@@ -54,7 +54,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_db_instance", "aws_dms_replication_instance", "aws_rds_cluster_instance", "aws_redshift_cluster"},
-		DefaultSeverity: severity.Medium,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if publicAttr := resourceBlock.GetAttribute("publicly_accessible"); publicAttr != nil && publicAttr.Type() == cty.Bool {
@@ -63,8 +63,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' is exposed publicly.", resourceBlock.FullName())).
 							WithRange(publicAttr.Range()).
-							WithAttributeAnnotation(publicAttr).
-							WithSeverity(severity.Medium),
+							WithAttributeAnnotation(publicAttr),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws012.go b/internal/app/tfsec/rules/aws012.go
index 4ba803ef2..a6fb4c62b 100644
--- a/internal/app/tfsec/rules/aws012.go
+++ b/internal/app/tfsec/rules/aws012.go
@@ -21,8 +21,8 @@ import (
 
 const AWSResourceHasPublicIP = "AWS012"
 const AWSResourceHasPublicIPDescription = "A resource has a public IP address."
-const AWSResourceHasPublicIPImpact = "The instance or configuration is publically accessible"
-const AWSResourceHasPublicIPResolution = "Set the instance to not be publically accessible"
+const AWSResourceHasPublicIPImpact = "The instance or configuration is publicly accessible"
+const AWSResourceHasPublicIPResolution = "Set the instance to not be publicly accessible"
 const AWSResourceHasPublicIPExplanation = `
 You should limit the provision of public IP addresses for resources. Resources should not be exposed on the public internet, but should have access limited to consumers required for the function of your application. 
 `
@@ -65,8 +65,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' has a public IP address associated.", resourceBlock.FullName())).
 							WithRange(publicAttr.Range()).
-							WithAttributeAnnotation(publicAttr).
-							WithSeverity(severity.High),
+							WithAttributeAnnotation(publicAttr),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws013.go b/internal/app/tfsec/rules/aws013.go
index 4103089d0..bb2d7b0c6 100644
--- a/internal/app/tfsec/rules/aws013.go
+++ b/internal/app/tfsec/rules/aws013.go
@@ -84,7 +84,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_ecs_task_definition"},
-		DefaultSeverity: severity.Medium,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if definitionsAttr := resourceBlock.GetAttribute("container_definitions"); definitionsAttr != nil && definitionsAttr.Type() == cty.String {
@@ -108,8 +108,7 @@ func init() {
 							set.Add(result.New(resourceBlock).
 								WithDescription(fmt.Sprintf("Resource '%s' includes a potentially sensitive environment variable '%s' in the container definition.", resourceBlock.FullName(), env.Name)).
 								WithRange(definitionsAttr.Range()).
-								WithAttributeAnnotation(definitionsAttr).
-								WithSeverity(severity.Medium),
+								WithAttributeAnnotation(definitionsAttr),
 							)
 						}
 					}
diff --git a/internal/app/tfsec/rules/aws014.go b/internal/app/tfsec/rules/aws014.go
index 99c8782de..4ff68391d 100644
--- a/internal/app/tfsec/rules/aws014.go
+++ b/internal/app/tfsec/rules/aws014.go
@@ -24,7 +24,7 @@ const AWSLaunchConfigurationWithUnencryptedBlockDeviceDescription = "Launch conf
 const AWSLaunchConfigurationWithUnencryptedBlockDeviceImpact = "The block device is could be compromised and read from"
 const AWSLaunchConfigurationWithUnencryptedBlockDeviceResolution = "Turn on encryption for all block devices"
 const AWSLaunchConfigurationWithUnencryptedBlockDeviceExplanation = `
-Blocks devices should be encrypted to ensure sensitive data is hel securely at rest.
+Blocks devices should be encrypted to ensure sensitive data is held securely at rest.
 `
 const AWSLaunchConfigurationWithUnencryptedBlockDeviceBadExample = `
 resource "aws_launch_configuration" "bad_example" {
@@ -76,8 +76,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' uses an unencrypted root EBS block device. Consider adding <blue>root_block_device{ encrypted = true }</blue>", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 			} else if rootDeviceBlock != nil {
 				checkDeviceEncryption(rootDeviceBlock, encryptionByDefault, set, resourceBlock)
@@ -98,16 +97,14 @@ func checkDeviceEncryption(deviceBlock block.Block, encryptionByDefault bool, se
 		set.Add(
 			result.New(resourceBlock).
 				WithDescription(fmt.Sprintf("Resource '%s' uses an unencrypted EBS block device. Consider adding <blue>encrypted = true</blue>", resourceBlock.FullName())).
-				WithRange(deviceBlock.Range()).
-				WithSeverity(severity.High),
+				WithRange(deviceBlock.Range()),
 		)
 	} else if encryptedAttr != nil && encryptedAttr.Type() == cty.Bool && encryptedAttr.Value().False() {
 		set.Add(
 			result.New(resourceBlock).
 				WithDescription(fmt.Sprintf("Resource '%s' uses an unencrypted root EBS block device.", resourceBlock.FullName())).
 				WithRange(encryptedAttr.Range()).
-				WithAttributeAnnotation(encryptedAttr).
-				WithSeverity(severity.High),
+				WithAttributeAnnotation(encryptedAttr),
 		)
 	}
 }
diff --git a/internal/app/tfsec/rules/aws015.go b/internal/app/tfsec/rules/aws015.go
index 6bc75ad78..84ead9f1a 100644
--- a/internal/app/tfsec/rules/aws015.go
+++ b/internal/app/tfsec/rules/aws015.go
@@ -63,8 +63,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted SQS queue.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 
 			} else if kmsKeyIDAttr.Type() == cty.String && kmsKeyIDAttr.Value().AsString() == "" {
@@ -72,8 +71,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted SQS queue.", resourceBlock.FullName())).
 						WithRange(kmsKeyIDAttr.Range()).
-						WithAttributeAnnotation(kmsKeyIDAttr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(kmsKeyIDAttr),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws016.go b/internal/app/tfsec/rules/aws016.go
index f30cc76dc..4751bc315 100644
--- a/internal/app/tfsec/rules/aws016.go
+++ b/internal/app/tfsec/rules/aws016.go
@@ -63,8 +63,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted SNS topic.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			} else if kmsKeyIDAttr.Type() == cty.String && kmsKeyIDAttr.Value().AsString() == "" {
@@ -72,8 +71,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted SNS topic.", resourceBlock.FullName())).
 						WithRange(kmsKeyIDAttr.Range()).
-						WithAttributeAnnotation(kmsKeyIDAttr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(kmsKeyIDAttr),
 				)
 				return
 			}
@@ -91,8 +89,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' explicitly uses the default CMK", resourceBlock.FullName())).
 							WithRange(kmsKeyIDAttr.Range()).
-							WithAttributeAnnotation(kmsKeyIDAttr).
-							WithSeverity(severity.Medium),
+							WithAttributeAnnotation(kmsKeyIDAttr),
 					)
 				}
 
diff --git a/internal/app/tfsec/rules/aws017.go b/internal/app/tfsec/rules/aws017.go
index 26a1a9c27..bb676f625 100644
--- a/internal/app/tfsec/rules/aws017.go
+++ b/internal/app/tfsec/rules/aws017.go
@@ -69,8 +69,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted S3 bucket (missing server_side_encryption_configuration block).", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -79,8 +78,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted S3 bucket (missing rule block).", resourceBlock.FullName())).
-						WithRange(encryptionBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(encryptionBlock.Range()),
 				)
 				return
 			}
@@ -90,8 +88,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted S3 bucket (missing apply_server_side_encryption_by_default block).", resourceBlock.FullName())).
-						WithRange(ruleBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(ruleBlock.Range()),
 				)
 				return
 			}
@@ -101,8 +98,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted S3 bucket (missing sse_algorithm attribute).", resourceBlock.FullName())).
-						WithRange(applyBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(applyBlock.Range()),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws018.go b/internal/app/tfsec/rules/aws018.go
index 11a6b8156..53917c409 100644
--- a/internal/app/tfsec/rules/aws018.go
+++ b/internal/app/tfsec/rules/aws018.go
@@ -73,14 +73,13 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_security_group", "aws_security_group_rule"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Low,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			if resourceBlock.MissingChild("description") {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should include a description for auditing purposes.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -91,8 +90,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should include a non-empty description for auditing purposes.", resourceBlock.FullName())).
 						WithRange(descriptionAttr.Range()).
-						WithAttributeAnnotation(descriptionAttr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(descriptionAttr),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws019.go b/internal/app/tfsec/rules/aws019.go
index f9f789024..46099be1a 100644
--- a/internal/app/tfsec/rules/aws019.go
+++ b/internal/app/tfsec/rules/aws019.go
@@ -69,8 +69,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not have KMS Key auto-rotation enabled.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Medium),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -80,8 +79,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not have KMS Key auto-rotation enabled.", resourceBlock.FullName())).
 						WithRange(keyRotationAttr.Range()).
-						WithAttributeAnnotation(keyRotationAttr).
-						WithSeverity(severity.Medium),
+						WithAttributeAnnotation(keyRotationAttr),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws020.go b/internal/app/tfsec/rules/aws020.go
index 9d55cde2f..b7348f353 100644
--- a/internal/app/tfsec/rules/aws020.go
+++ b/internal/app/tfsec/rules/aws020.go
@@ -61,7 +61,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_cloudfront_distribution"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, context *hclcontext.Context) {
 
 			defaultBehaviorBlock := resourceBlock.GetBlock("default_cache_behavior")
@@ -69,8 +69,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a CloudFront distribution that allows unencrypted communications (missing default_cache_behavior block).", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 			} else {
 				protocolPolicyAttr := defaultBehaviorBlock.GetAttribute("viewer_protocol_policy")
@@ -78,16 +77,14 @@ func init() {
 					set.Add(
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' defines a CloudFront distribution that allows unencrypted communications (missing viewer_protocol_policy block).", resourceBlock.FullName())).
-							WithRange(resourceBlock.Range()).
-							WithSeverity(severity.High),
+							WithRange(resourceBlock.Range()),
 					)
 				} else if protocolPolicyAttr.Type() == cty.String && protocolPolicyAttr.Value().AsString() == "allow-all" {
 					set.Add(
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' defines a CloudFront distribution that allows unencrypted communications.", resourceBlock.FullName())).
 							WithRange(protocolPolicyAttr.Range()).
-							WithAttributeAnnotation(protocolPolicyAttr).
-							WithSeverity(severity.High),
+							WithAttributeAnnotation(protocolPolicyAttr),
 					)
 				}
 			}
@@ -99,16 +96,14 @@ func init() {
 					set.Add(
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' defines a CloudFront distribution that allows unencrypted communications (missing viewer_protocol_policy block).", resourceBlock.FullName())).
-							WithRange(resourceBlock.Range()).
-							WithSeverity(severity.High),
+							WithRange(resourceBlock.Range()),
 					)
 				} else if orderedProtocolPolicyAttr.Type() == cty.String && orderedProtocolPolicyAttr.Value().AsString() == "allow-all" {
 					set.Add(
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' defines a CloudFront distribution that allows unencrypted communications.", resourceBlock.FullName())).
 							WithRange(orderedProtocolPolicyAttr.Range()).
-							WithAttributeAnnotation(orderedProtocolPolicyAttr).
-							WithSeverity(severity.High),
+							WithAttributeAnnotation(orderedProtocolPolicyAttr),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws021.go b/internal/app/tfsec/rules/aws021.go
index b1e818407..f64c18427 100644
--- a/internal/app/tfsec/rules/aws021.go
+++ b/internal/app/tfsec/rules/aws021.go
@@ -69,8 +69,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines outdated SSL/TLS policies (missing viewer_certificate block)", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -79,15 +78,13 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines outdated SSL/TLS policies (missing minimum_protocol_version attribute)", resourceBlock.FullName())).
-						WithRange(viewerCertificateBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(viewerCertificateBlock.Range()),
 				)
 			} else if minVersion.Type() == cty.String && minVersion.Value().AsString() != "TLSv1.2_2021" {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines outdated SSL/TLS policies (not using TLSv1.2_2021)", resourceBlock.FullName())).
-						WithRange(minVersion.Range()).
-						WithSeverity(severity.High),
+						WithRange(minVersion.Range()),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws022.go b/internal/app/tfsec/rules/aws022.go
index ed98e3360..d13004913 100644
--- a/internal/app/tfsec/rules/aws022.go
+++ b/internal/app/tfsec/rules/aws022.go
@@ -71,8 +71,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a MSK cluster that allows plaintext as well as TLS encrypted data in transit (missing encryption_info block).", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Medium),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -82,8 +81,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a MSK cluster that allows plaintext as well as TLS encrypted data in transit (missing encryption_in_transit block).", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Medium),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -93,24 +91,21 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a MSK cluster that allows plaintext as well as TLS encrypted data in transit (missing client_broker block).", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Medium),
+						WithRange(resourceBlock.Range()),
 				)
 			} else if clientBrokerAttr.Value().AsString() == "PLAINTEXT" {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a MSK cluster that only allows plaintext data in transit.", resourceBlock.FullName())).
 						WithRange(clientBrokerAttr.Range()).
-						WithAttributeAnnotation(clientBrokerAttr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(clientBrokerAttr),
 				)
 			} else if clientBrokerAttr.Value().AsString() == "TLS_PLAINTEXT" {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a MSK cluster that allows plaintext as well as TLS encrypted data in transit.", resourceBlock.FullName())).
 						WithRange(clientBrokerAttr.Range()).
-						WithAttributeAnnotation(clientBrokerAttr).
-						WithSeverity(severity.Medium),
+						WithAttributeAnnotation(clientBrokerAttr),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws023.go b/internal/app/tfsec/rules/aws023.go
index 96b11ea4a..52f83d88c 100644
--- a/internal/app/tfsec/rules/aws023.go
+++ b/internal/app/tfsec/rules/aws023.go
@@ -72,8 +72,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a disabled ECR image scan.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -85,16 +84,14 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a disabled ECR image scan.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 			} else if ecrScanStatusAttr.Type() == cty.Bool && ecrScanStatusAttr.Value().False() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a disabled ECR image scan.", resourceBlock.FullName())).
 						WithRange(ecrScanStatusAttr.Range()).
-						WithAttributeAnnotation(ecrScanStatusAttr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(ecrScanStatusAttr),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws024.go b/internal/app/tfsec/rules/aws024.go
index 313cff26a..0d0af790b 100644
--- a/internal/app/tfsec/rules/aws024.go
+++ b/internal/app/tfsec/rules/aws024.go
@@ -65,16 +65,14 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted Kinesis Stream.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 			} else if encryptionTypeAttr.Type() == cty.String && strings.ToUpper(encryptionTypeAttr.Value().AsString()) != "KMS" {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted Kinesis Stream.", resourceBlock.FullName())).
 						WithRange(encryptionTypeAttr.Range()).
-						WithAttributeAnnotation(encryptionTypeAttr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(encryptionTypeAttr),
 				)
 			} else {
 				keyIDAttr := resourceBlock.GetAttribute("kms_key_id")
@@ -82,8 +80,7 @@ func init() {
 					set.Add(
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' defines a Kinesis Stream encrypted with the default Kinesis key.", resourceBlock.FullName())).
-							WithRange(resourceBlock.Range()).
-							WithSeverity(severity.Medium),
+							WithRange(resourceBlock.Range()),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws025.go b/internal/app/tfsec/rules/aws025.go
index 10036f33c..3bfe5f79e 100644
--- a/internal/app/tfsec/rules/aws025.go
+++ b/internal/app/tfsec/rules/aws025.go
@@ -63,8 +63,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should include security_policy (defaults to outdated SSL/TLS policy).", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -74,8 +73,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines outdated SSL/TLS policies (not using TLS_1_2).", resourceBlock.FullName())).
 						WithRange(securityPolicyAttr.Range()).
-						WithAttributeAnnotation(securityPolicyAttr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(securityPolicyAttr),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws031.go b/internal/app/tfsec/rules/aws031.go
index d5dde6112..fe86c7837 100644
--- a/internal/app/tfsec/rules/aws031.go
+++ b/internal/app/tfsec/rules/aws031.go
@@ -71,8 +71,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted Elasticsearch domain (missing encrypt_at_rest block).", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -82,8 +81,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted Elasticsearch domain (missing enabled attribute).", resourceBlock.FullName())).
-						WithRange(encryptionBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(encryptionBlock.Range()),
 				)
 				return
 			}
@@ -96,8 +94,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted Elasticsearch domain (enabled attribute set to false).", resourceBlock.FullName())).
-						WithRange(encryptionBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(encryptionBlock.Range()),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws032.go b/internal/app/tfsec/rules/aws032.go
index a96aad9f7..40f9db256 100644
--- a/internal/app/tfsec/rules/aws032.go
+++ b/internal/app/tfsec/rules/aws032.go
@@ -71,8 +71,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an Elasticsearch domain with plaintext traffic (missing node_to_node_encryption block).", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -82,8 +81,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an Elasticsearch domain with plaintext traffic (missing enabled attribute).", resourceBlock.FullName())).
-						WithRange(encryptionBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(encryptionBlock.Range()),
 				)
 				return
 			}
@@ -96,8 +94,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an Elasticsearch domain with plaintext traffic (enabled attribute set to false).", resourceBlock.FullName())).
-						WithRange(encryptionBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(encryptionBlock.Range()),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws033.go b/internal/app/tfsec/rules/aws033.go
index 7da371eb2..981b9d7ac 100644
--- a/internal/app/tfsec/rules/aws033.go
+++ b/internal/app/tfsec/rules/aws033.go
@@ -65,7 +65,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_elasticsearch_domain"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, context *hclcontext.Context) {
 
 			endpointBlock := resourceBlock.GetBlock("domain_endpoint_options")
@@ -73,8 +73,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an Elasticsearch domain with plaintext traffic (missing domain_endpoint_options block).", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -84,8 +83,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an Elasticsearch domain with plaintext traffic (missing enforce_https attribute).", resourceBlock.FullName())).
-						WithRange(endpointBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(endpointBlock.Range()),
 				)
 				return
 			}
@@ -98,8 +96,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an Elasticsearch domain with plaintext traffic (enabled attribute set to false).", resourceBlock.FullName())).
-						WithRange(endpointBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(endpointBlock.Range()),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws034.go b/internal/app/tfsec/rules/aws034.go
index 3ab0be01b..2ae61463e 100644
--- a/internal/app/tfsec/rules/aws034.go
+++ b/internal/app/tfsec/rules/aws034.go
@@ -79,8 +79,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an Elasticsearch domain with an outdated TLS policy (defaults to Policy-Min-TLS-1-0-2019-07).", resourceBlock.FullName())).
-						WithRange(endpointBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(endpointBlock.Range()),
 				)
 				return
 			}
@@ -90,8 +89,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an Elasticsearch domain with an outdated TLS policy (set to Policy-Min-TLS-1-0-2019-07).", resourceBlock.FullName())).
 						WithRange(tlsPolicyAttr.Range()).
-						WithAttributeAnnotation(tlsPolicyAttr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(tlsPolicyAttr),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws035.go b/internal/app/tfsec/rules/aws035.go
index d3016abab..f4a5f1048 100644
--- a/internal/app/tfsec/rules/aws035.go
+++ b/internal/app/tfsec/rules/aws035.go
@@ -67,16 +67,14 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted Elasticache Replication Group (missing at_rest_encryption_enabled attribute).", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 			} else if !isBooleanOrStringTrue(encryptionAttr) {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted Elasticache Replication Group (at_rest_encryption_enabled set to false).", resourceBlock.FullName())).
 						WithRange(encryptionAttr.Range()).
-						WithAttributeAnnotation(encryptionAttr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(encryptionAttr),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws036.go b/internal/app/tfsec/rules/aws036.go
index 9b654e625..fed20c0b2 100644
--- a/internal/app/tfsec/rules/aws036.go
+++ b/internal/app/tfsec/rules/aws036.go
@@ -67,16 +67,14 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted Elasticache Replication Group (missing transit_encryption_enabled attribute).", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 			} else if !isBooleanOrStringTrue(encryptionAttr) {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted Elasticache Replication Group (transit_encryption_enabled set to false).", resourceBlock.FullName())).
 						WithRange(encryptionAttr.Range()).
-						WithAttributeAnnotation(encryptionAttr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(encryptionAttr),
 				)
 
 			}
diff --git a/internal/app/tfsec/rules/aws037.go b/internal/app/tfsec/rules/aws037.go
index d825f5407..63b31cc2d 100644
--- a/internal/app/tfsec/rules/aws037.go
+++ b/internal/app/tfsec/rules/aws037.go
@@ -70,8 +70,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not have a password reuse prevention count set.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Medium),
+						WithRange(resourceBlock.Range()),
 				)
 			} else if attr.Value().Type() == cty.Number {
 				value, _ := attr.Value().AsBigFloat().Float64()
@@ -79,8 +78,7 @@ func init() {
 					set.Add(
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' has a password reuse count less than 5.", resourceBlock.FullName())).
-							WithRange(resourceBlock.Range()).
-							WithSeverity(severity.Medium),
+							WithRange(resourceBlock.Range()),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws038.go b/internal/app/tfsec/rules/aws038.go
index 1c1ea4bb4..ca7148c14 100644
--- a/internal/app/tfsec/rules/aws038.go
+++ b/internal/app/tfsec/rules/aws038.go
@@ -69,8 +69,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not have a max password age set.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Medium),
+						WithRange(resourceBlock.Range()),
 				)
 			} else if attr.Value().Type() == cty.Number {
 				value, _ := attr.Value().AsBigFloat().Float64()
@@ -79,8 +78,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' has high password age.", resourceBlock.FullName())).
 							WithRange(attr.Range()).
-							WithAttributeAnnotation(attr).
-							WithSeverity(severity.Medium),
+							WithAttributeAnnotation(attr),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws039.go b/internal/app/tfsec/rules/aws039.go
index d83fc5558..352073697 100644
--- a/internal/app/tfsec/rules/aws039.go
+++ b/internal/app/tfsec/rules/aws039.go
@@ -69,8 +69,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not have a minimum password length set.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Medium),
+						WithRange(resourceBlock.Range()),
 				)
 			} else if attr.Value().Type() == cty.Number {
 				value, _ := attr.Value().AsBigFloat().Float64()
@@ -78,8 +77,7 @@ func init() {
 					set.Add(
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' has a minimum password length which is less than 14 characters.", resourceBlock.FullName())).
-							WithRange(resourceBlock.Range()).
-							WithSeverity(severity.Medium),
+							WithRange(resourceBlock.Range()),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws040.go b/internal/app/tfsec/rules/aws040.go
index 00d5ce772..d1dd60e5f 100644
--- a/internal/app/tfsec/rules/aws040.go
+++ b/internal/app/tfsec/rules/aws040.go
@@ -67,16 +67,14 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not require a symbol in the password.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Medium),
+						WithRange(resourceBlock.Range()),
 				)
 			} else if attr.Value().Type() == cty.Bool {
 				if attr.Value().False() {
 					set.Add(
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' explicitly specifies not requiring at least one symbol in the password.", resourceBlock.FullName())).
-							WithRange(resourceBlock.Range()).
-							WithSeverity(severity.Medium),
+							WithRange(resourceBlock.Range()),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws041.go b/internal/app/tfsec/rules/aws041.go
index 4c435696d..2861e6d20 100644
--- a/internal/app/tfsec/rules/aws041.go
+++ b/internal/app/tfsec/rules/aws041.go
@@ -67,16 +67,14 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not require a number in the password.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Medium),
+						WithRange(resourceBlock.Range()),
 				)
 			} else if attr.Value().Type() == cty.Bool {
 				if attr.Value().False() {
 					set.Add(
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' explicitly specifies not requiring at least one number in the password.", resourceBlock.FullName())).
-							WithRange(resourceBlock.Range()).
-							WithSeverity(severity.Medium),
+							WithRange(resourceBlock.Range()),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws042.go b/internal/app/tfsec/rules/aws042.go
index 6e3faff9f..449a4a8b1 100644
--- a/internal/app/tfsec/rules/aws042.go
+++ b/internal/app/tfsec/rules/aws042.go
@@ -67,16 +67,14 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not require a lowercase character in the password.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Medium),
+						WithRange(resourceBlock.Range()),
 				)
 			} else if attr.Value().Type() == cty.Bool {
 				if attr.Value().False() {
 					set.Add(
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' explicitly specifies not requiring at least lowercase character in the password.", resourceBlock.FullName())).
-							WithRange(resourceBlock.Range()).
-							WithSeverity(severity.Medium),
+							WithRange(resourceBlock.Range()),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws043.go b/internal/app/tfsec/rules/aws043.go
index 51b6f11c7..d221ee180 100644
--- a/internal/app/tfsec/rules/aws043.go
+++ b/internal/app/tfsec/rules/aws043.go
@@ -67,16 +67,14 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not require an uppercase character in the password.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Medium),
+						WithRange(resourceBlock.Range()),
 				)
 			} else if attr.Value().Type() == cty.Bool {
 				if attr.Value().False() {
 					set.Add(
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' explicitly specifies not requiring at least one uppercase character in the password.", resourceBlock.FullName())).
-							WithRange(resourceBlock.Range()).
-							WithSeverity(severity.Medium),
+							WithRange(resourceBlock.Range()),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws044.go b/internal/app/tfsec/rules/aws044.go
index 77e39a989..840dba1f3 100644
--- a/internal/app/tfsec/rules/aws044.go
+++ b/internal/app/tfsec/rules/aws044.go
@@ -54,7 +54,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"provider"},
 		RequiredLabels:  []string{"aws"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if accessKeyAttribute := resourceBlock.GetAttribute("access_key"); accessKeyAttribute != nil && accessKeyAttribute.Type() == cty.String {
@@ -62,16 +62,14 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Provider '%s' has an access key specified.", resourceBlock.FullName())).
 						WithRange(accessKeyAttribute.Range()).
-						WithAttributeAnnotation(accessKeyAttribute).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(accessKeyAttribute),
 				)
 			} else if secretKeyAttribute := resourceBlock.GetAttribute("secret_key"); secretKeyAttribute != nil && secretKeyAttribute.Type() == cty.String {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Provider '%s' has a secret key specified.", resourceBlock.FullName())).
 						WithRange(secretKeyAttribute.Range()).
-						WithAttributeAnnotation(secretKeyAttribute).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(secretKeyAttribute),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws045.go b/internal/app/tfsec/rules/aws045.go
index b40270e34..9cafa595d 100644
--- a/internal/app/tfsec/rules/aws045.go
+++ b/internal/app/tfsec/rules/aws045.go
@@ -108,7 +108,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_cloudfront_distribution"},
-		DefaultSeverity: severity.Medium,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, context *hclcontext.Context) {
 
 			wafAclIdBlock := resourceBlock.GetAttribute("web_acl_id")
@@ -116,8 +116,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not have a WAF in front of it.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Medium),
+						WithRange(resourceBlock.Range()),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws046.go b/internal/app/tfsec/rules/aws046.go
index e33acf39f..bc5f020ac 100644
--- a/internal/app/tfsec/rules/aws046.go
+++ b/internal/app/tfsec/rules/aws046.go
@@ -69,7 +69,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"data"},
 		RequiredLabels:  []string{"aws_iam_policy_document"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if statementBlocks := resourceBlock.GetBlocks("statement"); statementBlocks != nil {
@@ -86,8 +86,7 @@ func init() {
 								set.Add(
 									result.New(resourceBlock).
 										WithDescription(fmt.Sprintf("Resource '%s' has a wildcard action specified.", resourceBlock.FullName())).
-										WithRange(statementBlock.Range()).
-										WithSeverity(severity.High),
+										WithRange(statementBlock.Range()),
 								)
 							}
 						}
diff --git a/internal/app/tfsec/rules/aws047.go b/internal/app/tfsec/rules/aws047.go
index 7f2a2d380..0d952e3c4 100644
--- a/internal/app/tfsec/rules/aws047.go
+++ b/internal/app/tfsec/rules/aws047.go
@@ -108,8 +108,7 @@ func init() {
 						set.Add(
 							result.New(resourceBlock).
 								WithDescription(fmt.Sprintf("SQS policy '%s' has a wildcard action specified.", resourceBlock.FullName())).
-								WithRange(resourceBlock.Range()).
-								WithSeverity(severity.High),
+								WithRange(resourceBlock.Range()),
 						)
 					}
 				}
diff --git a/internal/app/tfsec/rules/aws048.go b/internal/app/tfsec/rules/aws048.go
index 1890fa4b9..f98e827a4 100644
--- a/internal/app/tfsec/rules/aws048.go
+++ b/internal/app/tfsec/rules/aws048.go
@@ -66,16 +66,14 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not specify if encryption should be used.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 			} else if efsEnabledAttr.Type() == cty.Bool && efsEnabledAttr.Value().False() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' actively does not have encryption applied.", resourceBlock.FullName())).
 						WithRange(efsEnabledAttr.Range()).
-						WithAttributeAnnotation(efsEnabledAttr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(efsEnabledAttr),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws049.go b/internal/app/tfsec/rules/aws049.go
index 527b8cf82..eaddc2d67 100644
--- a/internal/app/tfsec/rules/aws049.go
+++ b/internal/app/tfsec/rules/aws049.go
@@ -63,7 +63,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_network_acl_rule"},
-		DefaultSeverity: severity.Medium,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			egressAttr := resourceBlock.GetAttribute("egress")
@@ -87,8 +87,7 @@ func init() {
 						set.Add(
 							result.New(resourceBlock).
 								WithDescription(fmt.Sprintf("Resource '%s' defines a Network ACL rule that allows specific ingress ports from anywhere.", resourceBlock.FullName())).
-								WithRange(cidrBlockAttr.Range()).
-								WithSeverity(severity.Medium),
+								WithRange(cidrBlockAttr.Range()),
 						)
 					}
 				}
@@ -105,8 +104,7 @@ func init() {
 							result.New(resourceBlock).
 								WithDescription(fmt.Sprintf("Resource '%s' defines a Network ACL rule that allows specific ingress ports from anywhere.", resourceBlock.FullName())).
 								WithRange(ipv6CidrBlockAttr.Range()).
-								WithAttributeAnnotation(ipv6CidrBlockAttr).
-								WithSeverity(severity.Medium),
+								WithAttributeAnnotation(ipv6CidrBlockAttr),
 						)
 					}
 				}
diff --git a/internal/app/tfsec/rules/aws050.go b/internal/app/tfsec/rules/aws050.go
index a67c9a991..6390a6a3b 100644
--- a/internal/app/tfsec/rules/aws050.go
+++ b/internal/app/tfsec/rules/aws050.go
@@ -62,7 +62,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_network_acl_rule"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			egressAttr := resourceBlock.GetAttribute("egress")
@@ -88,8 +88,7 @@ func init() {
 							result.New(resourceBlock).
 								WithDescription(fmt.Sprintf("Resource '%s' defines a fully open ingress Network ACL rule with ALL ports open.", resourceBlock.FullName())).
 								WithRange(cidrBlockAttr.Range()).
-								WithAttributeAnnotation(cidrBlockAttr).
-								WithSeverity(severity.High),
+								WithAttributeAnnotation(cidrBlockAttr),
 						)
 					}
 				}
@@ -102,8 +101,7 @@ func init() {
 							result.New(resourceBlock).
 								WithDescription(fmt.Sprintf("Resource '%s' defines a fully open ingress Network ACL rule with ALL ports open.", resourceBlock.FullName())).
 								WithRange(ipv6CidrBlockAttr.Range()).
-								WithAttributeAnnotation(ipv6CidrBlockAttr).
-								WithSeverity(severity.High),
+								WithAttributeAnnotation(ipv6CidrBlockAttr),
 						)
 					}
 				}
diff --git a/internal/app/tfsec/rules/aws051.go b/internal/app/tfsec/rules/aws051.go
index bcbd08ff2..46cd311a9 100644
--- a/internal/app/tfsec/rules/aws051.go
+++ b/internal/app/tfsec/rules/aws051.go
@@ -67,24 +67,21 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a disabled RDS Cluster encryption.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 			} else if kmsKeyIdAttr != nil && kmsKeyIdAttr.Equals("") {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a disabled RDS Cluster encryption.", resourceBlock.FullName())).
 						WithRange(kmsKeyIdAttr.Range()).
-						WithAttributeAnnotation(kmsKeyIdAttr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(kmsKeyIdAttr),
 				)
 			} else if storageEncryptedattr == nil || storageEncryptedattr.IsFalse() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a enabled RDS Cluster encryption but not the required encrypted_storage.", resourceBlock.FullName())).
 						WithRange(kmsKeyIdAttr.Range()).
-						WithAttributeAnnotation(kmsKeyIdAttr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(kmsKeyIdAttr),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws052.go b/internal/app/tfsec/rules/aws052.go
index c7fb0f1c8..0ae3dcdc9 100644
--- a/internal/app/tfsec/rules/aws052.go
+++ b/internal/app/tfsec/rules/aws052.go
@@ -62,8 +62,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has no storage encryption defined.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -74,8 +73,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has storage encrypted set to false", resourceBlock.FullName())).
 						WithRange(storageEncryptedAttr.Range()).
-						WithAttributeAnnotation(storageEncryptedAttr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(storageEncryptedAttr),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws053.go b/internal/app/tfsec/rules/aws053.go
index 22adc7c74..84ff79a64 100644
--- a/internal/app/tfsec/rules/aws053.go
+++ b/internal/app/tfsec/rules/aws053.go
@@ -68,8 +68,7 @@ func init() {
 					set.Add(
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' defines Performance Insights without encryption key specified.", resourceBlock.FullName())).
-							WithRange(resourceBlock.Range()).
-							WithSeverity(severity.High),
+							WithRange(resourceBlock.Range()),
 					)
 					return
 				}
@@ -79,8 +78,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' defines Performance Insights without encryption key specified.", resourceBlock.FullName())).
 							WithRange(keyAttr.Range()).
-							WithAttributeAnnotation(keyAttr).
-							WithSeverity(severity.High),
+							WithAttributeAnnotation(keyAttr),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws057.go b/internal/app/tfsec/rules/aws057.go
index a28c7de24..ee479cbcf 100644
--- a/internal/app/tfsec/rules/aws057.go
+++ b/internal/app/tfsec/rules/aws057.go
@@ -90,15 +90,14 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_elasticsearch_domain"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("log_publishing_options") {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not configure logging at rest on the domain.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -111,8 +110,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' explicitly disables logging on the domain.", resourceBlock.FullName())).
 							WithRange(enabledAttr.Range()).
-							WithAttributeAnnotation(enabledAttr).
-							WithSeverity(severity.High),
+							WithAttributeAnnotation(enabledAttr),
 					)
 					return
 				}
diff --git a/internal/app/tfsec/rules/aws058.go b/internal/app/tfsec/rules/aws058.go
index bf0e1a732..2f592e047 100644
--- a/internal/app/tfsec/rules/aws058.go
+++ b/internal/app/tfsec/rules/aws058.go
@@ -62,7 +62,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_lambda_permission"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.HasChild("principal") {
@@ -71,8 +71,7 @@ func init() {
 						set.Add(
 							result.New(resourceBlock).
 								WithDescription(fmt.Sprintf("Resource '%s' missing source ARN but has *.amazonaws.com Principal.", resourceBlock.FullName())).
-								WithRange(resourceBlock.Range()).
-								WithSeverity(severity.High),
+								WithRange(resourceBlock.Range()),
 						)
 					}
 				}
diff --git a/internal/app/tfsec/rules/aws059.go b/internal/app/tfsec/rules/aws059.go
index 3f502549b..58f16f581 100644
--- a/internal/app/tfsec/rules/aws059.go
+++ b/internal/app/tfsec/rules/aws059.go
@@ -114,8 +114,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' missing encryption configuration block.", blockName)).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws060.go b/internal/app/tfsec/rules/aws060.go
index 6aa56d06f..f15c83a54 100644
--- a/internal/app/tfsec/rules/aws060.go
+++ b/internal/app/tfsec/rules/aws060.go
@@ -93,8 +93,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' is missing the configuration block.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -105,8 +104,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has enforce_workgroup_configuration set to false.", resourceBlock.FullName())).
-						WithRange(configBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(configBlock.Range()),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws061.go b/internal/app/tfsec/rules/aws061.go
index c1d7a4095..4ced178e3 100644
--- a/internal/app/tfsec/rules/aws061.go
+++ b/internal/app/tfsec/rules/aws061.go
@@ -77,15 +77,14 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_apigatewayv2_stage", "aws_api_gateway_stage"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("access_log_settings") {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' is missing access log settings block.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws062.go b/internal/app/tfsec/rules/aws062.go
index a0cbacefd..eb94c6a9d 100644
--- a/internal/app/tfsec/rules/aws062.go
+++ b/internal/app/tfsec/rules/aws062.go
@@ -72,7 +72,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_instance"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("user_data") {
@@ -86,8 +86,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has userdata with access key id defined.", resourceBlock.FullName())).
 						WithRange(userDataAttr.Range()).
-						WithAttributeAnnotation(userDataAttr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(userDataAttr),
 				)
 			}
 
@@ -97,8 +96,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has userdata with access secret key defined.", resourceBlock.FullName())).
 						WithRange(userDataAttr.Range()).
-						WithAttributeAnnotation(userDataAttr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(userDataAttr),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws063.go b/internal/app/tfsec/rules/aws063.go
index 5bfe97ad1..368b3a8a6 100644
--- a/internal/app/tfsec/rules/aws063.go
+++ b/internal/app/tfsec/rules/aws063.go
@@ -77,8 +77,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not set multi region trail config.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Medium),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -89,8 +88,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not enable multi region trail.", resourceBlock.FullName())).
 						WithRange(multiRegionAttr.Range()).
-						WithAttributeAnnotation(multiRegionAttr).
-						WithSeverity(severity.Medium),
+						WithAttributeAnnotation(multiRegionAttr),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws064.go b/internal/app/tfsec/rules/aws064.go
index 0df0d9940..d853d7ab1 100644
--- a/internal/app/tfsec/rules/aws064.go
+++ b/internal/app/tfsec/rules/aws064.go
@@ -74,14 +74,13 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_cloudtrail"},
-		DefaultSeverity: severity.Medium,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			if resourceBlock.MissingChild("enable_log_file_validation") {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not enable log file validation.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Medium),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -92,8 +91,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not enable log file validation.", resourceBlock.FullName())).
 						WithRange(logFileValidationAttr.Range()).
-						WithAttributeAnnotation(logFileValidationAttr).
-						WithSeverity(severity.Medium),
+						WithAttributeAnnotation(logFileValidationAttr),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws065.go b/internal/app/tfsec/rules/aws065.go
index 68d6dbff1..53bb517ed 100644
--- a/internal/app/tfsec/rules/aws065.go
+++ b/internal/app/tfsec/rules/aws065.go
@@ -82,8 +82,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not have a kms_key_id set.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -94,8 +93,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has a kms_key_id but it is not set.", resourceBlock.FullName())).
 						WithRange(kmsKeyIdAttr.Range()).
-						WithAttributeAnnotation(kmsKeyIdAttr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(kmsKeyIdAttr),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws066.go b/internal/app/tfsec/rules/aws066.go
index 42c8bca93..2c608bca3 100644
--- a/internal/app/tfsec/rules/aws066.go
+++ b/internal/app/tfsec/rules/aws066.go
@@ -76,8 +76,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has no encryptionConfigBlock block", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -87,8 +86,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has encryptionConfigBlock block with no resourcesAttr attribute specified", resourceBlock.FullName())).
-						WithRange(encryptionConfigBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(encryptionConfigBlock.Range()),
 				)
 				return
 			}
@@ -99,8 +97,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not include secrets in encrypted resources", resourceBlock.FullName())).
 						WithRange(resourcesAttr.Range()).
-						WithAttributeAnnotation(resourcesAttr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(resourcesAttr),
 				)
 			}
 
@@ -108,8 +105,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has encryptionConfigBlock block with no provider block specified", resourceBlock.FullName())).
-						WithRange(encryptionConfigBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(encryptionConfigBlock.Range()),
 				)
 				return
 			}
@@ -119,8 +115,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has encryptionConfigBlock block with provider block specified missing key arn", resourceBlock.FullName())).
-						WithRange(encryptionConfigBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(encryptionConfigBlock.Range()),
 				)
 				return
 			}
@@ -131,8 +126,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has encryptionConfigBlock block with provider block specified but key_arn is empty", resourceBlock.FullName())).
 						WithRange(keyArnAttr.Range()).
-						WithAttributeAnnotation(keyArnAttr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(keyArnAttr),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws067.go b/internal/app/tfsec/rules/aws067.go
index 626a1340e..2dab4ba42 100644
--- a/internal/app/tfsec/rules/aws067.go
+++ b/internal/app/tfsec/rules/aws067.go
@@ -77,7 +77,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_eks_cluster"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			controlPlaneLogging := []string{"api", "audit", "authenticator", "controllerManager", "scheduler"}
@@ -86,8 +86,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' missing the enabled_cluster_log_types attribute to enable control plane logging", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -99,8 +98,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' is missing the control plane log type '%s'", resourceBlock.FullName(), logType)).
 							WithRange(configuredLoggingAttr.Range()).
-							WithAttributeAnnotation(configuredLoggingAttr).
-							WithSeverity(severity.High),
+							WithAttributeAnnotation(configuredLoggingAttr),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws068.go b/internal/app/tfsec/rules/aws068.go
index 9ea79a9ea..fc7f2fbf9 100644
--- a/internal/app/tfsec/rules/aws068.go
+++ b/internal/app/tfsec/rules/aws068.go
@@ -66,15 +66,14 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_eks_cluster"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("vpc_config") {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has no vpc_config block specified so default public access cidrs is set", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -84,8 +83,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' is using default public access cidrs in the vpc config", resourceBlock.FullName())).
-						WithRange(vpcConfig.Range()).
-						WithSeverity(severity.High),
+						WithRange(vpcConfig.Range()),
 				)
 				return
 			}
@@ -96,8 +94,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has public access cidr explicitly set to wide open", resourceBlock.FullName())).
 						WithRange(publicAccessCidrsAttr.Range()).
-						WithAttributeAnnotation(publicAccessCidrsAttr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(publicAccessCidrsAttr),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws069.go b/internal/app/tfsec/rules/aws069.go
index b0d5b6166..7c9a5a795 100644
--- a/internal/app/tfsec/rules/aws069.go
+++ b/internal/app/tfsec/rules/aws069.go
@@ -66,15 +66,14 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_eks_cluster"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("vpc_config") {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has no vpc_config block specified so default public access is enabled", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -84,8 +83,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' is using default public access in the vpc config", resourceBlock.FullName())).
-						WithRange(vpcConfig.Range()).
-						WithSeverity(severity.High),
+						WithRange(vpcConfig.Range()),
 				)
 				return
 			}
@@ -96,8 +94,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has public access is explicitly set to enabled", resourceBlock.FullName())).
 						WithRange(publicAccessEnabledAttr.Range()).
-						WithAttributeAnnotation(publicAccessEnabledAttr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(publicAccessEnabledAttr),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws070.go b/internal/app/tfsec/rules/aws070.go
index be6f79d62..0640dd5dd 100644
--- a/internal/app/tfsec/rules/aws070.go
+++ b/internal/app/tfsec/rules/aws070.go
@@ -64,7 +64,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_elasticsearch_domain"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			logPublishingOptions := resourceBlock.GetBlocks("log_publishing_options")
 			if len(logPublishingOptions) > 0 {
@@ -82,8 +82,7 @@ func init() {
 					set.Add(
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' is missing 'AUDIT_LOGS` in one of the `log_publishing_options`-`log_type` attributes so audit log is not enabled", resourceBlock.FullName())).
-							WithRange(resourceBlock.Range()).
-							WithSeverity(severity.High),
+							WithRange(resourceBlock.Range()),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws071.go b/internal/app/tfsec/rules/aws071.go
index 2397905f1..32bd29406 100644
--- a/internal/app/tfsec/rules/aws071.go
+++ b/internal/app/tfsec/rules/aws071.go
@@ -59,15 +59,14 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_cloudfront_distribution"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("logging_config") {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not have Access Logging configured", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws072.go b/internal/app/tfsec/rules/aws072.go
index 4a68b66ef..2742d71d4 100644
--- a/internal/app/tfsec/rules/aws072.go
+++ b/internal/app/tfsec/rules/aws072.go
@@ -88,7 +88,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_cloudfront_distribution"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if defaultCacheBlock := resourceBlock.GetBlock("default_cache_behavior"); defaultCacheBlock != nil {
@@ -96,8 +96,7 @@ func init() {
 					set.Add(
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' does not use HTTPS in Viewer Protocol Policy", resourceBlock.FullName())).
-							WithRange(defaultCacheBlock.Range()).
-							WithSeverity(severity.High),
+							WithRange(defaultCacheBlock.Range()),
 					)
 				}
 			}
@@ -108,8 +107,7 @@ func init() {
 					set.Add(
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' does not use HTTPS in Viewer Protocol Policy", resourceBlock.FullName())).
-							WithRange(orderedCacheBlock.Range()).
-							WithSeverity(severity.High),
+							WithRange(orderedCacheBlock.Range()),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws073.go b/internal/app/tfsec/rules/aws073.go
index c3c0b090e..ae0956dc7 100644
--- a/internal/app/tfsec/rules/aws073.go
+++ b/internal/app/tfsec/rules/aws073.go
@@ -68,8 +68,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not specify ignore_public_acls, defaults to false", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -80,8 +79,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' sets ignore_public_acls explicitly to false", resourceBlock.FullName())).
 						WithRange(attr.Range()).
-						WithAttributeAnnotation(attr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(attr),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws074.go b/internal/app/tfsec/rules/aws074.go
index 5c5cb046a..a1cfaa09c 100644
--- a/internal/app/tfsec/rules/aws074.go
+++ b/internal/app/tfsec/rules/aws074.go
@@ -67,8 +67,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not specify block_public_acls, defaults to false", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -79,8 +78,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' sets block_public_acls explicitly to false", resourceBlock.FullName())).
 						WithRange(attr.Range()).
-						WithAttributeAnnotation(attr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(attr),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws075.go b/internal/app/tfsec/rules/aws075.go
index 0d230b74e..4a8ca2a8a 100644
--- a/internal/app/tfsec/rules/aws075.go
+++ b/internal/app/tfsec/rules/aws075.go
@@ -67,8 +67,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not specify restrict_public_buckets, defaults to false", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -79,8 +78,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' sets restrict_public_buckets explicitly to false", resourceBlock.FullName())).
 						WithRange(attr.Range()).
-						WithAttributeAnnotation(attr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(attr),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws076.go b/internal/app/tfsec/rules/aws076.go
index cf6f083b2..57eb0eacb 100644
--- a/internal/app/tfsec/rules/aws076.go
+++ b/internal/app/tfsec/rules/aws076.go
@@ -22,7 +22,7 @@ const AWSBlockPublicPolicyS3Description = "S3 Access block should block public p
 const AWSBlockPublicPolicyS3Impact = "Users could put a policy that allows public access"
 const AWSBlockPublicPolicyS3Resolution = "Prevent policies that allow public access being PUT"
 const AWSBlockPublicPolicyS3Explanation = `
-S3 bucket policy should have block public policy to prevent users from PUTing a policy that enable public access.
+S3 bucket policy should have block public policy to prevent users from putting a policy that enable public access.
 `
 const AWSBlockPublicPolicyS3BadExample = `
 resource "aws_s3_bucket_public_access_block" "bad_example" {
@@ -67,8 +67,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not specify block_public_policy, defaults to false", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -79,8 +78,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' sets block_public_policy explicitly to false", resourceBlock.FullName())).
 						WithRange(attr.Range()).
-						WithAttributeAnnotation(attr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(attr),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws077.go b/internal/app/tfsec/rules/aws077.go
index 52e7edec4..b4a717764 100644
--- a/internal/app/tfsec/rules/aws077.go
+++ b/internal/app/tfsec/rules/aws077.go
@@ -58,15 +58,14 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_s3_bucket"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("versioning") {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not have versioning enabled", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -76,8 +75,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has versioning block but is disabled", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws078.go b/internal/app/tfsec/rules/aws078.go
index 4ac99b776..2cd71f2d8 100644
--- a/internal/app/tfsec/rules/aws078.go
+++ b/internal/app/tfsec/rules/aws078.go
@@ -73,8 +73,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' is missing `image_tag_mutability` attribute - it is required to make ecr image tag immutable.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -84,8 +83,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has `image_tag_mutability` attribute  not set to `IMMUTABLE`", resourceBlock.FullName())).
 						WithRange(imageTagMutabilityAttr.Range()).
-						WithAttributeAnnotation(imageTagMutabilityAttr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(imageTagMutabilityAttr),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws079.go b/internal/app/tfsec/rules/aws079.go
index 9758bf2c0..89b80b224 100644
--- a/internal/app/tfsec/rules/aws079.go
+++ b/internal/app/tfsec/rules/aws079.go
@@ -68,8 +68,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' is missing `metadata_options` block - it is required with `http_tokens` set to `required` to make Instance Metadata Service more secure.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -88,8 +87,7 @@ func init() {
 					set.Add(
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' `metadata_options` `http_tokens` attribute - should be set to `required` to make Instance Metadata Service more secure.", resourceBlock.FullName())).
-							WithRange(httpTokensAttr.Range()).
-							WithSeverity(severity.High),
+							WithRange(httpTokensAttr.Range()),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws080.go b/internal/app/tfsec/rules/aws080.go
index 79abaefb3..a7d00e383 100644
--- a/internal/app/tfsec/rules/aws080.go
+++ b/internal/app/tfsec/rules/aws080.go
@@ -121,16 +121,14 @@ func init() {
 							result.New(resourceBlock).
 								WithDescription(fmt.Sprintf("CodeBuild project '%s' is configured to disable artifact encryption while no artifacts are produced", resourceBlock.FullName())).
 								WithRange(artifactBlock.Range()).
-								WithAttributeAnnotation(artifactTypeAttr).
-								WithSeverity(severity.Medium),
+								WithAttributeAnnotation(artifactTypeAttr),
 						)
 					} else {
 						set.Add(
 							result.New(resourceBlock).
 								WithDescription(fmt.Sprintf("CodeBuild project '%s' does not encrypt produced artifacts", resourceBlock.FullName())).
 								WithRange(artifactBlock.Range()).
-								WithAttributeAnnotation(encryptionDisabledAttr).
-								WithSeverity(severity.High),
+								WithAttributeAnnotation(encryptionDisabledAttr),
 						)
 					}
 				}
diff --git a/internal/app/tfsec/rules/aws081.go b/internal/app/tfsec/rules/aws081.go
index 88b68d77b..90b138549 100644
--- a/internal/app/tfsec/rules/aws081.go
+++ b/internal/app/tfsec/rules/aws081.go
@@ -80,8 +80,7 @@ func init() {
 			if resourceBlock.MissingChild("server_side_encryption") {
 				res := result.New(resourceBlock).
 					WithDescription(fmt.Sprintf("DAX cluster '%s' does not have server side encryption configured. By default it is disabled.", resourceBlock.FullName())).
-					WithRange(resourceBlock.Range()).
-					WithSeverity(severity.High)
+					WithRange(resourceBlock.Range())
 				set.Add(res)
 				return
 			}
@@ -90,8 +89,7 @@ func init() {
 			if sseBlock.MissingChild("enabled") {
 				res := result.New(resourceBlock).
 					WithDescription(fmt.Sprintf("DAX cluster '%s' server side encryption block is empty. By default SSE is disabled.", resourceBlock.FullName())).
-					WithRange(sseBlock.Range()).
-					WithSeverity(severity.High)
+					WithRange(sseBlock.Range())
 				set.Add(res)
 				return
 			}
@@ -100,8 +98,7 @@ func init() {
 				res := result.New(resourceBlock).
 					WithDescription(fmt.Sprintf("DAX cluster '%s' has disabled server side encryption", resourceBlock.FullName())).
 					WithRange(sseEnabledAttr.Range()).
-					WithAttributeAnnotation(sseEnabledAttr).
-					WithSeverity(severity.High)
+					WithAttributeAnnotation(sseEnabledAttr)
 				set.Add(res)
 			}
 
diff --git a/internal/app/tfsec/rules/aws082.go b/internal/app/tfsec/rules/aws082.go
index 9599f037f..cfbaa6268 100644
--- a/internal/app/tfsec/rules/aws082.go
+++ b/internal/app/tfsec/rules/aws082.go
@@ -18,7 +18,7 @@ import (
 )
 
 const AWSDontUseDefaultAWSVPC = "AWS082"
-const AWSDontUseDefaultAWSVPCDescription = "It is AWS best practice to not use the default VPC for workflows"
+const AWSDontUseDefaultAWSVPCDescription = "AWS best practice to not use the default VPC for workflows"
 const AWSDontUseDefaultAWSVPCImpact = "The default VPC does not have critical security features applied"
 const AWSDontUseDefaultAWSVPCResolution = "Create a non-default vpc for resources to be created in"
 const AWSDontUseDefaultAWSVPCExplanation = `
@@ -58,8 +58,7 @@ func init() {
 			set.Add(
 				result.New(resourceBlock).
 					WithDescription(fmt.Sprintf("Resource '%s' should not exist", resourceBlock.FullName())).
-					WithRange(resourceBlock.Range()).
-					WithSeverity(severity.High),
+					WithRange(resourceBlock.Range()),
 			)
 		},
 	})
diff --git a/internal/app/tfsec/rules/aws083.go b/internal/app/tfsec/rules/aws083.go
index 97b026818..01a6247c1 100644
--- a/internal/app/tfsec/rules/aws083.go
+++ b/internal/app/tfsec/rules/aws083.go
@@ -87,8 +87,7 @@ func init() {
 					set.Add(
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' does not drop invalid header fields", resourceBlock.FullName())).
-							WithRange(resourceBlock.Range()).
-							WithSeverity(severity.High),
+							WithRange(resourceBlock.Range()),
 					)
 					return
 				}
@@ -99,8 +98,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' sets the drop_invalid_header_fields to false", resourceBlock.FullName())).
 							WithRange(attr.Range()).
-							WithAttributeAnnotation(attr).
-							WithSeverity(severity.High),
+							WithAttributeAnnotation(attr),
 					)
 				}
 
diff --git a/internal/app/tfsec/rules/aws084.go b/internal/app/tfsec/rules/aws084.go
index 08d088c21..e46bc9723 100644
--- a/internal/app/tfsec/rules/aws084.go
+++ b/internal/app/tfsec/rules/aws084.go
@@ -82,17 +82,15 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should have root volume encryption enables", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 			} else {
 				attr := resourceBlock.GetAttribute("root_volume_encryption_enabled")
 				if attr != nil && attr.IsFalse() {
 					set.Add(result.New(resourceBlock).
-						WithDescription(fmt.Sprintf("Resource '%s' has the root volume encyption set to false", resourceBlock.FullName())).
+						WithDescription(fmt.Sprintf("Resource '%s' has the root volume encryption set to false", resourceBlock.FullName())).
 						WithRange(attr.Range()).
-						WithAttributeAnnotation(attr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(attr),
 					)
 				}
 			}
@@ -100,8 +98,7 @@ func init() {
 			if resourceBlock.MissingChild("user_volume_encryption_enabled") {
 				set.Add(result.New(resourceBlock).
 					WithDescription(fmt.Sprintf("Resource '%s' should have user volume encryption enables", resourceBlock.FullName())).
-					WithRange(resourceBlock.Range()).
-					WithSeverity(severity.High),
+					WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -110,10 +107,9 @@ func init() {
 			if attr != nil && attr.IsFalse() {
 				set.Add(
 					result.New(resourceBlock).
-						WithDescription(fmt.Sprintf("Resource '%s' has the user volume encyption set to false", resourceBlock.FullName())).
+						WithDescription(fmt.Sprintf("Resource '%s' has the user volume encryption set to false", resourceBlock.FullName())).
 						WithRange(attr.Range()).
-						WithAttributeAnnotation(attr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(attr),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws085.go b/internal/app/tfsec/rules/aws085.go
index 80947b529..9d4f9f073 100644
--- a/internal/app/tfsec/rules/aws085.go
+++ b/internal/app/tfsec/rules/aws085.go
@@ -73,8 +73,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should have account aggregation sources set", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -83,8 +82,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should have account aggregation sources to all regions", resourceBlock.FullName())).
-						WithRange(aggBlock.Range()).
-						WithSeverity(severity.Medium),
+						WithRange(aggBlock.Range()),
 				)
 				return
 			}
@@ -95,8 +93,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has all_regions set to false", resourceBlock.FullName())).
 						WithRange(allRegionsAttr.Range()).
-						WithAttributeAnnotation(allRegionsAttr).
-						WithSeverity(severity.Medium),
+						WithAttributeAnnotation(allRegionsAttr),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws086.go b/internal/app/tfsec/rules/aws086.go
index 55c3d0497..f344e0f0f 100644
--- a/internal/app/tfsec/rules/aws086.go
+++ b/internal/app/tfsec/rules/aws086.go
@@ -22,7 +22,7 @@ const AWSDynamoDBRecoveryEnabledDescription = "Point in time recovery should be
 const AWSDynamoDBRecoveryEnabledImpact = "Accidental or malicious writes and deletes can't be rolled back"
 const AWSDynamoDBRecoveryEnabledResolution = "Enable point in time recovery"
 const AWSDynamoDBRecoveryEnabledExplanation = `
-DynamoDB tables should be protected against accidentally or malicious write/delete actions by ensuring that there is adaquate protection.
+DynamoDB tables should be protected against accidentally or malicious write/delete actions by ensuring that there is adequate protection.
 
 By enabling point-in-time-recovery you can restore to a known point in the event of loss of data.
 `
@@ -84,8 +84,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' doesn't have point in time recovery", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Medium),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -95,8 +94,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' doesn't have point in time recovery enabled", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Medium),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -106,8 +104,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' doesn't have point in time recovery enabled", resourceBlock.FullName())).
 						WithRange(enabledAttr.Range()).
-						WithAttributeAnnotation(enabledAttr).
-						WithSeverity(severity.Medium),
+						WithAttributeAnnotation(enabledAttr),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws087.go b/internal/app/tfsec/rules/aws087.go
index dbc0e5d36..e7e2d81c3 100644
--- a/internal/app/tfsec/rules/aws087.go
+++ b/internal/app/tfsec/rules/aws087.go
@@ -73,8 +73,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' is being deployed outside of a VPC", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws088.go b/internal/app/tfsec/rules/aws088.go
index b0688109d..aab23d1f3 100644
--- a/internal/app/tfsec/rules/aws088.go
+++ b/internal/app/tfsec/rules/aws088.go
@@ -18,7 +18,7 @@ import (
 )
 
 const AWSRedisClusterBackupRetention = "AWS088"
-const AWSRedisClusterBackupRetentionDescription = "Redis cluster should be backup retention turned on"
+const AWSRedisClusterBackupRetentionDescription = "Redis cluster should have backup retention turned on"
 const AWSRedisClusterBackupRetentionImpact = "Without backups of the redis cluster recovery is made difficult"
 const AWSRedisClusterBackupRetentionResolution = "Configure snapshot retention for redis cluster"
 const AWSRedisClusterBackupRetentionExplanation = `
@@ -79,8 +79,7 @@ func init() {
 						set.Add(
 							result.New(resourceBlock).
 								WithDescription(fmt.Sprintf("Resource '%s' should have snapshot retention specified", resourceBlock.FullName())).
-								WithRange(resourceBlock.Range()).
-								WithSeverity(severity.Medium),
+								WithRange(resourceBlock.Range()),
 						)
 						return
 					}
@@ -90,8 +89,7 @@ func init() {
 							result.New(resourceBlock).
 								WithDescription(fmt.Sprintf("Resource '%s' has snapshot retention set to 0", resourceBlock.FullName())).
 								WithRange(snapshotRetentionAttr.Range()).
-								WithAttributeAnnotation(snapshotRetentionAttr).
-								WithSeverity(severity.Medium),
+								WithAttributeAnnotation(snapshotRetentionAttr),
 						)
 					}
 				}
diff --git a/internal/app/tfsec/rules/aws089.go b/internal/app/tfsec/rules/aws089.go
index a6eacbb4f..6d86f7bb1 100644
--- a/internal/app/tfsec/rules/aws089.go
+++ b/internal/app/tfsec/rules/aws089.go
@@ -62,8 +62,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' is only using default encryption", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Low),
+						WithRange(resourceBlock.Range()),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws090.go b/internal/app/tfsec/rules/aws090.go
index 88ee9d113..bb21abcfb 100644
--- a/internal/app/tfsec/rules/aws090.go
+++ b/internal/app/tfsec/rules/aws090.go
@@ -70,8 +70,7 @@ func init() {
 								result.New(resourceBlock).
 									WithDescription(fmt.Sprintf("Resource '%s' has containerInsights set to disabled", resourceBlock.FullName())).
 									WithRange(setting.Range()).
-									WithAttributeAnnotation(valueAttr).
-									WithSeverity(severity.Low),
+									WithAttributeAnnotation(valueAttr),
 							)
 						}
 						return
@@ -80,9 +79,8 @@ func init() {
 			}
 			set.Add(
 				result.New(resourceBlock).
-					WithDescription(fmt.Sprintf("Resoure '%s' does not have containerInsights enabled", resourceBlock.FullName())).
-					WithRange(resourceBlock.Range()).
-					WithSeverity(severity.Low),
+					WithDescription(fmt.Sprintf("Resource '%s' does not have containerInsights enabled", resourceBlock.FullName())).
+					WithRange(resourceBlock.Range()),
 			)
 		},
 	})
diff --git a/internal/app/tfsec/rules/aws091.go b/internal/app/tfsec/rules/aws091.go
index 0560cac59..6ca6d5892 100644
--- a/internal/app/tfsec/rules/aws091.go
+++ b/internal/app/tfsec/rules/aws091.go
@@ -94,7 +94,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_rds_cluster", "aws_db_instance"},
-		DefaultSeverity: severity.Low,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			if resourceBlock.HasChild("replicate_source_db") {
 				return
@@ -104,8 +104,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not have backup retention explicitly set", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Low),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -116,8 +115,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has backup retention period set to a low value", resourceBlock.FullName())).
 						WithRange(retentionAttr.Range()).
-						WithAttributeAnnotation(retentionAttr).
-						WithSeverity(severity.Low),
+						WithAttributeAnnotation(retentionAttr),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws092.go b/internal/app/tfsec/rules/aws092.go
index 80475f646..7cc1379ea 100644
--- a/internal/app/tfsec/rules/aws092.go
+++ b/internal/app/tfsec/rules/aws092.go
@@ -18,9 +18,9 @@ import (
 )
 
 const AWSDynamoDBTableEncryption = "AWS092"
-const AWSDynamoDBTableEncryptionDescription = "DynamoDB tables should use at rest encyption with a Customer Managed Key"
+const AWSDynamoDBTableEncryptionDescription = "DynamoDB tables should use at rest encryption with a Customer Managed Key"
 const AWSDynamoDBTableEncryptionImpact = "Using AWS managed keys does not allow for fine grained control"
-const AWSDynamoDBTableEncryptionResolution = "Enable server side encrytion with a customer managed key"
+const AWSDynamoDBTableEncryptionResolution = "Enable server side encryption with a customer managed key"
 const AWSDynamoDBTableEncryptionExplanation = `
 DynamoDB tables are encrypted by default using AWS managed encryption keys. To increase control of the encryption and control the management of factors like key rotation, use a Customer Managed Key.
 `
@@ -103,8 +103,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' is not using KMS CMK for encryption", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Low),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -116,8 +115,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has server side encryption configured but disabled", resourceBlock.FullName())).
 						WithRange(enabledAttr.Range()).
-						WithAttributeAnnotation(enabledAttr).
-						WithSeverity(severity.Low),
+						WithAttributeAnnotation(enabledAttr),
 				)
 			}
 
@@ -128,8 +126,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' has KMS encryption configured but is using the default aws key", resourceBlock.FullName())).
 							WithRange(keyIdAttr.Range()).
-							WithAttributeAnnotation(keyIdAttr).
-							WithSeverity(severity.Low),
+							WithAttributeAnnotation(keyIdAttr),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws093.go b/internal/app/tfsec/rules/aws093.go
index 616e8668b..062146a01 100644
--- a/internal/app/tfsec/rules/aws093.go
+++ b/internal/app/tfsec/rules/aws093.go
@@ -80,8 +80,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not have CMK encryption configured", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Low),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -91,8 +90,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' configures encryption without using CMK", resourceBlock.FullName())).
-						WithRange(encBlock.Range()).
-						WithSeverity(severity.Low),
+						WithRange(encBlock.Range()),
 				)
 				return
 			}
@@ -101,8 +99,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should have the encryption type set to KMS", resourceBlock.FullName())).
-						WithRange(encBlock.Range()).
-						WithSeverity(severity.Low),
+						WithRange(encBlock.Range()),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws094.go b/internal/app/tfsec/rules/aws094.go
index 2e770a9a6..cfc235e3d 100644
--- a/internal/app/tfsec/rules/aws094.go
+++ b/internal/app/tfsec/rules/aws094.go
@@ -69,15 +69,14 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_redshift_cluster"},
-		DefaultSeverity: severity.Medium,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("encrypted") {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not have encryption enabled", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Medium),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -88,8 +87,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has encryption explicitly disabled", resourceBlock.FullName())).
 						WithRange(encryptedAttr.Range()).
-						WithAttributeAnnotation(encryptedAttr).
-						WithSeverity(severity.Medium),
+						WithAttributeAnnotation(encryptedAttr),
 				)
 				return
 			}
@@ -98,8 +96,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not have a customer managed key specified", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Medium),
+						WithRange(resourceBlock.Range()),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws095.go b/internal/app/tfsec/rules/aws095.go
index 7a9b26690..a2f18b2e0 100644
--- a/internal/app/tfsec/rules/aws095.go
+++ b/internal/app/tfsec/rules/aws095.go
@@ -65,8 +65,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not use CMK", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Low),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -83,8 +82,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' explicitly uses the default CMK", resourceBlock.FullName())).
 							WithRange(kmsKeyAttr.Range()).
-							WithAttributeAnnotation(kmsKeyAttr).
-							WithSeverity(severity.Low),
+							WithAttributeAnnotation(kmsKeyAttr),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws096.go b/internal/app/tfsec/rules/aws096.go
index eb1436fec..c7b8e5c33 100644
--- a/internal/app/tfsec/rules/aws096.go
+++ b/internal/app/tfsec/rules/aws096.go
@@ -101,8 +101,7 @@ func init() {
 					set.Add(
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' has efs configuration with in transit encryption implicitly disabled", resourceBlock.FullName())).
-							WithRange(resourceBlock.Range()).
-							WithSeverity(severity.High),
+							WithRange(resourceBlock.Range()),
 					)
 					continue
 				}
@@ -112,8 +111,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' has efs configuration with transit encryption explicitly disabled", resourceBlock.FullName())).
 							WithRange(transitAttr.Range()).
-							WithAttributeAnnotation(transitAttr).
-							WithSeverity(severity.High),
+							WithAttributeAnnotation(transitAttr),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws097.go b/internal/app/tfsec/rules/aws097.go
index 631aea6b1..84baf6e12 100644
--- a/internal/app/tfsec/rules/aws097.go
+++ b/internal/app/tfsec/rules/aws097.go
@@ -199,8 +199,7 @@ func init() {
 									result.New(policyDocumentBlock).
 										WithDescription(fmt.Sprintf("Resource '%s' a policy with KMS actions for all KMS keys.", policyDocumentBlock.FullName())).
 										WithRange(resources.Range()).
-										WithAttributeAnnotation(resources).
-										WithSeverity(severity.High),
+										WithAttributeAnnotation(resources),
 								)
 							}
 						}
@@ -230,8 +229,7 @@ func checkAWS097PolicyJSON(set result.Set, resourceBlock block.Block, policyAttr
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' a policy with KMS actions for all KMS keys.", resourceBlock.FullName())).
 							WithRange(policyAttr.Range()).
-							WithAttributeAnnotation(policyAttr).
-							WithSeverity(severity.High),
+							WithAttributeAnnotation(policyAttr),
 					)
 					return
 				}
diff --git a/internal/app/tfsec/rules/aws098.go b/internal/app/tfsec/rules/aws098.go
index b0c0b8872..aa99b7294 100644
--- a/internal/app/tfsec/rules/aws098.go
+++ b/internal/app/tfsec/rules/aws098.go
@@ -55,15 +55,14 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_s3_bucket"},
-		DefaultSeverity: severity.Low,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, ctx *hclcontext.Context) {
 			blocks, err := ctx.GetReferencingResources(resourceBlock, "aws_s3_bucket_public_access_block", "bucket")
 			if err != nil || len(blocks) == 0 {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource %s has no associated aws_s3_bucket_public_access_block.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Low),
+						WithRange(resourceBlock.Range()),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws099.go b/internal/app/tfsec/rules/aws099.go
index 11eaa9307..69d8c0cb3 100644
--- a/internal/app/tfsec/rules/aws099.go
+++ b/internal/app/tfsec/rules/aws099.go
@@ -109,7 +109,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_iam_policy", "aws_iam_user_policy", "aws_iam_group_policy", "aws_iam_role_policy"},
-		DefaultSeverity: severity.Low,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, ctx *hclcontext.Context) {
 			policyAttr := resourceBlock.GetAttribute("policy")
 			if policyAttr == nil {
diff --git a/internal/app/tfsec/rules/azu001.go b/internal/app/tfsec/rules/azu001.go
index 8dbf76dd8..e9ae2af6d 100644
--- a/internal/app/tfsec/rules/azu001.go
+++ b/internal/app/tfsec/rules/azu001.go
@@ -27,7 +27,7 @@ const AzureOpenInboundNetworkSecurityGroupRuleResolution = "Set a more restricti
 const AzureOpenInboundNetworkSecurityGroupRuleExplanation = `
 Network security rules should not use very broad subnets.
 
-Where possible, segements should be broken into smaller subnets.
+Where possible, segments should be broken into smaller subnets.
 `
 const AzureOpenInboundNetworkSecurityGroupRuleBadExample = `
 resource "azurerm_network_security_rule" "bad_example" {
@@ -60,7 +60,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_network_security_rule"},
-		DefaultSeverity: severity.Medium,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			directionAttr := resourceBlock.GetAttribute("direction")
@@ -79,8 +79,7 @@ func init() {
 									strings.ToLower(directionAttr.Value().AsString()),
 								)).
 								WithRange(prefixAttr.Range()).
-								WithAttributeAnnotation(prefixAttr).
-								WithSeverity(severity.Medium),
+								WithAttributeAnnotation(prefixAttr),
 						)
 					}
 				}
@@ -93,8 +92,7 @@ func init() {
 							result.New(resourceBlock).
 								WithDescription(fmt.Sprintf("Resource '%s' defines a fully open security group rule.", resourceBlock.FullName())).
 								WithRange(prefixesAttr.Range()).
-								WithAttributeAnnotation(prefixesAttr).
-								WithSeverity(severity.Medium),
+								WithAttributeAnnotation(prefixesAttr),
 						)
 					}
 				}
diff --git a/internal/app/tfsec/rules/azu002.go b/internal/app/tfsec/rules/azu002.go
index 4978314bc..c20275903 100644
--- a/internal/app/tfsec/rules/azu002.go
+++ b/internal/app/tfsec/rules/azu002.go
@@ -60,7 +60,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_network_security_rule"},
-		DefaultSeverity: severity.Medium,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			directionAttr := resourceBlock.GetAttribute("direction")
@@ -79,8 +79,7 @@ func init() {
 									strings.ToLower(directionAttr.Value().AsString()),
 								)).
 								WithRange(prefixAttr.Range()).
-								WithAttributeAnnotation(prefixAttr).
-								WithSeverity(severity.Medium),
+								WithAttributeAnnotation(prefixAttr),
 						)
 					}
 				}
@@ -93,8 +92,7 @@ func init() {
 							result.New(resourceBlock).
 								WithDescription(fmt.Sprintf("Resource '%s' defines a fully open security group rule.", resourceBlock.FullName())).
 								WithRange(prefixesAttr.Range()).
-								WithAttributeAnnotation(prefixesAttr).
-								WithSeverity(severity.Medium),
+								WithAttributeAnnotation(prefixesAttr),
 						)
 					}
 				}
diff --git a/internal/app/tfsec/rules/azu003.go b/internal/app/tfsec/rules/azu003.go
index dd3dcc039..d6bc79ff6 100644
--- a/internal/app/tfsec/rules/azu003.go
+++ b/internal/app/tfsec/rules/azu003.go
@@ -71,8 +71,7 @@ func init() {
 							resourceBlock.FullName(),
 						)).
 						WithRange(enabledAttr.Range()).
-						WithAttributeAnnotation(enabledAttr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(enabledAttr),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/azu004.go b/internal/app/tfsec/rules/azu004.go
index ce34c2f9d..26dd427c5 100644
--- a/internal/app/tfsec/rules/azu004.go
+++ b/internal/app/tfsec/rules/azu004.go
@@ -65,8 +65,7 @@ func init() {
 							resourceBlock.FullName(),
 						)).
 						WithRange(encryptionStateAttr.Range()).
-						WithAttributeAnnotation(encryptionStateAttr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(encryptionStateAttr),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/azu005.go b/internal/app/tfsec/rules/azu005.go
index 1afd26128..1f4d830a1 100644
--- a/internal/app/tfsec/rules/azu005.go
+++ b/internal/app/tfsec/rules/azu005.go
@@ -70,8 +70,7 @@ func init() {
 								resourceBlock.FullName(),
 							)).
 							WithRange(passwordAuthDisabledAttr.Range()).
-							WithAttributeAnnotation(passwordAuthDisabledAttr).
-							WithSeverity(severity.High),
+							WithAttributeAnnotation(passwordAuthDisabledAttr),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/azu006.go b/internal/app/tfsec/rules/azu006.go
index 2a0d49693..921d70077 100644
--- a/internal/app/tfsec/rules/azu006.go
+++ b/internal/app/tfsec/rules/azu006.go
@@ -57,7 +57,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_kubernetes_cluster"},
-		DefaultSeverity: severity.Medium,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if networkProfileBlock := resourceBlock.GetBlock("network_profile"); networkProfileBlock != nil {
@@ -65,8 +65,7 @@ func init() {
 					set.Add(
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' do not have network_policy define. network_policy should be defined to have opportunity allow or block traffic to pods", resourceBlock.FullName())).
-							WithRange(networkProfileBlock.Range()).
-							WithSeverity(severity.High),
+							WithRange(networkProfileBlock.Range()),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/azu007.go b/internal/app/tfsec/rules/azu007.go
index fe5f11abf..28a69fdee 100644
--- a/internal/app/tfsec/rules/azu007.go
+++ b/internal/app/tfsec/rules/azu007.go
@@ -66,8 +66,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines without RBAC", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -81,8 +80,7 @@ func init() {
 							resourceBlock.FullName(),
 						)).
 						WithRange(enabledAttr.Range()).
-						WithAttributeAnnotation(enabledAttr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(enabledAttr),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/azu008.go b/internal/app/tfsec/rules/azu008.go
index 2b825526e..f941fa8d1 100644
--- a/internal/app/tfsec/rules/azu008.go
+++ b/internal/app/tfsec/rules/azu008.go
@@ -55,7 +55,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_kubernetes_cluster"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if (resourceBlock.MissingChild("api_server_authorized_ip_ranges") ||
@@ -66,8 +66,7 @@ func init() {
 					set.Add(
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' defined without limited set of IP address ranges to the API server.", resourceBlock.FullName())).
-							WithRange(resourceBlock.Range()).
-							WithSeverity(severity.High),
+							WithRange(resourceBlock.Range()),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/azu009.go b/internal/app/tfsec/rules/azu009.go
index 48079120e..ecc2a41e5 100644
--- a/internal/app/tfsec/rules/azu009.go
+++ b/internal/app/tfsec/rules/azu009.go
@@ -58,7 +58,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_kubernetes_cluster"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			addonProfileBlock := resourceBlock.GetBlock("addon_profile")
@@ -66,8 +66,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' AKS logging to Azure Monitoring is not configured (missing addon_profile).", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -77,8 +76,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' AKS logging to Azure Monitoring is not configured (missing oms_agent).", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -90,8 +88,7 @@ func init() {
 					WithDescription(fmt.Sprintf(
 						"Resource '%s' AKS logging to Azure Monitoring is not configured (oms_agent disabled).",
 						resourceBlock.FullName(),
-					)).
-					WithSeverity(severity.High)
+					))
 
 				if enabledAttr != nil {
 					res.WithRange(enabledAttr.Range()).
diff --git a/internal/app/tfsec/rules/azu010.go b/internal/app/tfsec/rules/azu010.go
index b2228fa64..117858556 100644
--- a/internal/app/tfsec/rules/azu010.go
+++ b/internal/app/tfsec/rules/azu010.go
@@ -54,7 +54,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_storage_account", "enable_https_traffic_only"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			enabledAttr := resourceBlock.GetAttribute("enable_https_traffic_only")
@@ -66,8 +66,7 @@ func init() {
 							resourceBlock.FullName(),
 						)).
 						WithRange(enabledAttr.Range()).
-						WithAttributeAnnotation(enabledAttr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(enabledAttr),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/azu011.go b/internal/app/tfsec/rules/azu011.go
index 7cffde3a0..bd02cc94c 100644
--- a/internal/app/tfsec/rules/azu011.go
+++ b/internal/app/tfsec/rules/azu011.go
@@ -21,7 +21,7 @@ import (
 
 const AZUBlobStorageContainerNoPublicAccess = "AZU011"
 const AZUBlobStorageContainerNoPublicAccessDescription = "Storage containers in blob storage mode should not have public access"
-const AZUBlobStorageContainerNoPublicAccessImpact = "Data in the storage container could be exposed publically"
+const AZUBlobStorageContainerNoPublicAccessImpact = "Data in the storage container could be exposed publicly"
 const AZUBlobStorageContainerNoPublicAccessResolution = "Disable public access to storage containers"
 const AZUBlobStorageContainerNoPublicAccessExplanation = `
 Storage container public access should be off. It can be configured for blobs only, containers and blobs or off entirely. The default is off, with no public access.
@@ -79,8 +79,7 @@ func init() {
 						set.Add(
 							result.New(resourceBlock).
 								WithDescription(fmt.Sprintf("Resource '%s' defines publicAccess as '%s', should be 'off .", resourceBlock.FullName(), value)).
-								WithRange(resourceBlock.Range()).
-								WithSeverity(severity.High),
+								WithRange(resourceBlock.Range()),
 						)
 					}
 				}
diff --git a/internal/app/tfsec/rules/azu012.go b/internal/app/tfsec/rules/azu012.go
index 2fecc2aca..4663213e5 100644
--- a/internal/app/tfsec/rules/azu012.go
+++ b/internal/app/tfsec/rules/azu012.go
@@ -19,7 +19,7 @@ import (
 
 const AZUDefaultActionOnNetworkRuleSetToDeny = "AZU012"
 const AZUDefaultActionOnNetworkRuleSetToDenyDescription = "The default action on Storage account network rules should be set to deny"
-const AZUDefaultActionOnNetworkRuleSetToDenyImpact = "Network rules that allow could cause data to be exposed publically"
+const AZUDefaultActionOnNetworkRuleSetToDenyImpact = "Network rules that allow could cause data to be exposed publicly"
 const AZUDefaultActionOnNetworkRuleSetToDenyResolution = "Set network rules to deny"
 const AZUDefaultActionOnNetworkRuleSetToDenyExplanation = `
 The default_action for network rules should come into effect when no other rules are matched.
@@ -63,7 +63,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_storage_account", "azurerm_storage_account_network_rules"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.IsResourceType("azurerm_storage_account") {
@@ -78,8 +78,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a default_action of Allow. It should be Deny.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/azu013.go b/internal/app/tfsec/rules/azu013.go
index a02b1a5a2..6512f6b2e 100644
--- a/internal/app/tfsec/rules/azu013.go
+++ b/internal/app/tfsec/rules/azu013.go
@@ -124,8 +124,7 @@ func init() {
 					set.Add(
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' defines a network rule that doesn't allow bypass of Microsoft Services.", resourceBlock.FullName())).
-							WithRange(resourceBlock.Range()).
-							WithSeverity(severity.High),
+							WithRange(resourceBlock.Range()),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/azu014.go b/internal/app/tfsec/rules/azu014.go
index e79b3c817..b5b64b9d1 100644
--- a/internal/app/tfsec/rules/azu014.go
+++ b/internal/app/tfsec/rules/azu014.go
@@ -74,8 +74,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' explicitly turns off secure transfer to storage account.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/azu015.go b/internal/app/tfsec/rules/azu015.go
index f4b397376..288f0ea34 100644
--- a/internal/app/tfsec/rules/azu015.go
+++ b/internal/app/tfsec/rules/azu015.go
@@ -62,15 +62,14 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_storage_account"},
-		DefaultSeverity: severity.Medium,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("min_tls_version") || resourceBlock.GetAttribute("min_tls_version").IsNone("TLS1_2") {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should have the min tls version set to TLS1_2 .", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Medium),
+						WithRange(resourceBlock.Range()),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/azu016.go b/internal/app/tfsec/rules/azu016.go
index bc16a941f..44a0af262 100644
--- a/internal/app/tfsec/rules/azu016.go
+++ b/internal/app/tfsec/rules/azu016.go
@@ -85,8 +85,7 @@ func init() {
 					set.Add(
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' defines a Queue Services storage account without Storage Analytics logging.", resourceBlock.FullName())).
-							WithRange(resourceBlock.Range()).
-							WithSeverity(severity.Medium),
+							WithRange(resourceBlock.Range()),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/azu017.go b/internal/app/tfsec/rules/azu017.go
index 5661cb8fc..c7cd3f42c 100644
--- a/internal/app/tfsec/rules/azu017.go
+++ b/internal/app/tfsec/rules/azu017.go
@@ -96,7 +96,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_network_security_group", "azurerm_network_security_rule"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			var securityRules block.Blocks
@@ -116,8 +116,7 @@ func init() {
 							set.Add(
 								result.New(resourceBlock).
 									WithDescription(fmt.Sprintf("Resource '%s' has a .", resourceBlock.FullName())).
-									WithRange(resourceBlock.Range()).
-									WithSeverity(severity.High),
+									WithRange(resourceBlock.Range()),
 							)
 						}
 					}
diff --git a/internal/app/tfsec/rules/azu018.go b/internal/app/tfsec/rules/azu018.go
index 2f03812d3..b836f98fd 100644
--- a/internal/app/tfsec/rules/azu018.go
+++ b/internal/app/tfsec/rules/azu018.go
@@ -71,7 +71,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_sql_server", "azurerm_mssql_server"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, ctx *hclcontext.Context) {
 
 			if !resourceBlock.MissingChild("extended_auditing_policy") {
@@ -91,8 +91,7 @@ func init() {
 			set.Add(
 				result.New(resourceBlock).
 					WithDescription(fmt.Sprintf("Resource '%s' does not have an extended audit policy configured.", resourceBlock.FullName())).
-					WithRange(resourceBlock.Range()).
-					WithSeverity(severity.High),
+					WithRange(resourceBlock.Range()),
 			)
 
 		},
diff --git a/internal/app/tfsec/rules/azu019.go b/internal/app/tfsec/rules/azu019.go
index 945f699e8..aa79398ff 100644
--- a/internal/app/tfsec/rules/azu019.go
+++ b/internal/app/tfsec/rules/azu019.go
@@ -72,7 +72,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_sql_server", "azurerm_sql_server", "azurerm_mssql_database_extended_auditing_policy"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			if !resourceBlock.IsResourceType("azurerm_mssql_database_extended_auditing_policy") {
 				if resourceBlock.MissingChild("extended_auditing_policy") {
@@ -89,8 +89,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' specifies a retention period of less than 90 days.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/azu020.go b/internal/app/tfsec/rules/azu020.go
index 3ea2fc3bd..39be43747 100644
--- a/internal/app/tfsec/rules/azu020.go
+++ b/internal/app/tfsec/rules/azu020.go
@@ -68,15 +68,14 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_key_vault"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("network_acls") {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' specifies does not specify a network acl block.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -86,8 +85,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' specifies does not specify a network acl block.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -96,8 +94,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' specifies does not specify a default action in the network acl.", resourceBlock.FullName())).
-						WithRange(networkAcls.Range()).
-						WithSeverity(severity.High),
+						WithRange(networkAcls.Range()),
 				)
 				return
 			}
@@ -108,8 +105,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' specifies does not specify a network acl block.", resourceBlock.FullName())).
 						WithRange(defaultActionAttr.Range()).
-						WithAttributeAnnotation(defaultActionAttr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(defaultActionAttr),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/azu021.go b/internal/app/tfsec/rules/azu021.go
index 13123e7be..3f7991eb0 100644
--- a/internal/app/tfsec/rules/azu021.go
+++ b/internal/app/tfsec/rules/azu021.go
@@ -69,8 +69,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should have purge protection enabled.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Medium),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -78,8 +77,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should have soft_delete_retention_days set in order to enabled purge protection.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Medium),
+						WithRange(resourceBlock.Range()),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/azu022.go b/internal/app/tfsec/rules/azu022.go
index d78484ec0..23fdba62e 100644
--- a/internal/app/tfsec/rules/azu022.go
+++ b/internal/app/tfsec/rules/azu022.go
@@ -60,15 +60,14 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_key_vault_secret"},
-		DefaultSeverity: severity.Medium,
+		DefaultSeverity: severity.Low,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("content_type") {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should have a content type set.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Medium),
+						WithRange(resourceBlock.Range()),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/azu023.go b/internal/app/tfsec/rules/azu023.go
index 6c8ac03b8..18cdb2564 100644
--- a/internal/app/tfsec/rules/azu023.go
+++ b/internal/app/tfsec/rules/azu023.go
@@ -60,15 +60,14 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_key_vault_secret"},
-		DefaultSeverity: severity.Medium,
+		DefaultSeverity: severity.Low,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("expiration_date") {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should have an expiration date set.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Medium),
+						WithRange(resourceBlock.Range()),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/azu024.go b/internal/app/tfsec/rules/azu024.go
index aab4e4c0b..addba1e9e 100644
--- a/internal/app/tfsec/rules/azu024.go
+++ b/internal/app/tfsec/rules/azu024.go
@@ -97,7 +97,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_network_security_group", "azurerm_network_security_rule"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			var securityRules block.Blocks
@@ -117,8 +117,7 @@ func init() {
 							set.Add(
 								result.New(resourceBlock).
 									WithDescription(fmt.Sprintf("Resource '%s' has a source address prefix of *, 0.0.0.0, /0, internet or an any. Consider using the Azure Bastion Service.", resourceBlock.FullName())).
-									WithRange(resourceBlock.Range()).
-									WithSeverity(severity.High),
+									WithRange(resourceBlock.Range()),
 							)
 						}
 					}
diff --git a/internal/app/tfsec/rules/azu025.go b/internal/app/tfsec/rules/azu025.go
index a41470d5d..e176a9194 100644
--- a/internal/app/tfsec/rules/azu025.go
+++ b/internal/app/tfsec/rules/azu025.go
@@ -60,15 +60,14 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_data_factory"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("public_network_enabled") {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should have public_network_enabled set to false, the default is true.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -76,8 +75,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should not have public network set to true.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Medium),
+						WithRange(resourceBlock.Range()),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/azu026.go b/internal/app/tfsec/rules/azu026.go
index 591ecf51c..aa183b1e1 100644
--- a/internal/app/tfsec/rules/azu026.go
+++ b/internal/app/tfsec/rules/azu026.go
@@ -87,8 +87,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should have an expiration date set.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Medium),
+						WithRange(resourceBlock.Range()),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/azu027.go b/internal/app/tfsec/rules/azu027.go
index e4c9f749c..c640692f2 100644
--- a/internal/app/tfsec/rules/azu027.go
+++ b/internal/app/tfsec/rules/azu027.go
@@ -87,15 +87,14 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_synapse_workspace"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("managed_virtual_network_enabled") {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should have managed_virtual_network_enabled set to true, the default is false.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -105,8 +104,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should have managed_virtual_network_enabled set to true, the default is false.", resourceBlock.FullName())).
 						WithRange(managedNetworkAttr.Range()).
-						WithAttributeAnnotation(managedNetworkAttr).
-						WithSeverity(severity.Medium),
+						WithAttributeAnnotation(managedNetworkAttr),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/azu028.go b/internal/app/tfsec/rules/azu028.go
index 33138d78d..b2d5f4e64 100644
--- a/internal/app/tfsec/rules/azu028.go
+++ b/internal/app/tfsec/rules/azu028.go
@@ -67,15 +67,14 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_function_app"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("https_only") {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should have https_only set to true, the default is false.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -85,8 +84,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should have https_only set to true, the default is false.", resourceBlock.FullName())).
 						WithRange(httpsOnlyAttr.Range()).
-						WithAttributeAnnotation(httpsOnlyAttr).
-						WithSeverity(severity.Medium),
+						WithAttributeAnnotation(httpsOnlyAttr),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/dig001.go b/internal/app/tfsec/rules/dig001.go
index f1f454cf2..1c4cb4773 100644
--- a/internal/app/tfsec/rules/dig001.go
+++ b/internal/app/tfsec/rules/dig001.go
@@ -64,7 +64,7 @@ func init() {
 		Provider:        provider.DigitalOceanProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"digitalocean_firewall"},
-		DefaultSeverity: severity.Medium,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			inboundBlocks := resourceBlock.GetBlocks("inbound_rule")
@@ -79,8 +79,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' defines a fully open inbound_rule.", resourceBlock.FullName())).
 							WithRange(sourceAddressesAttr.Range()).
-							WithAttributeAnnotation(sourceAddressesAttr).
-							WithSeverity(severity.Medium),
+							WithAttributeAnnotation(sourceAddressesAttr),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/dig002.go b/internal/app/tfsec/rules/dig002.go
index 30822f62f..1a3673b41 100644
--- a/internal/app/tfsec/rules/dig002.go
+++ b/internal/app/tfsec/rules/dig002.go
@@ -64,7 +64,7 @@ func init() {
 		Provider:        provider.DigitalOceanProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"digitalocean_firewall"},
-		DefaultSeverity: severity.Medium, //TODO set the default severity
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			inboundBlocks := resourceBlock.GetBlocks("outbound_rule")
 
@@ -78,8 +78,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' defines a fully open outbound_rule.", resourceBlock.FullName())).
 							WithRange(destinationAddressesAttr.Range()).
-							WithAttributeAnnotation(destinationAddressesAttr).
-							WithSeverity(severity.Medium),
+							WithAttributeAnnotation(destinationAddressesAttr),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/dig003.go b/internal/app/tfsec/rules/dig003.go
index 7a80bf280..2b8e5e581 100644
--- a/internal/app/tfsec/rules/dig003.go
+++ b/internal/app/tfsec/rules/dig003.go
@@ -59,15 +59,14 @@ func init() {
 		Provider:        provider.DigitalOceanProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"digitalocean_droplet"},
-		DefaultSeverity: severity.Medium,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("ssh_keys") {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not define ssh_keys", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Medium),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -77,8 +76,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has ssh_key specified but is empty.", resourceBlock.FullName())).
 						WithRange(sshKeysAttr.Range()).
-						WithAttributeAnnotation(sshKeysAttr).
-						WithSeverity(severity.Medium),
+						WithAttributeAnnotation(sshKeysAttr),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/dig004.go b/internal/app/tfsec/rules/dig004.go
index b750487d6..592679e00 100644
--- a/internal/app/tfsec/rules/dig004.go
+++ b/internal/app/tfsec/rules/dig004.go
@@ -72,7 +72,7 @@ func init() {
 		Provider:        provider.DigitalOceanProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"digitalocean_loadbalancer"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("forwarding_rule") {
@@ -88,7 +88,6 @@ func init() {
 				if entryPointAttr.Equals("http", block.IgnoreCase) {
 					set.Add(result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' uses plain HTTP instead of HTTPS.", resourceBlock.FullName())).
-						WithSeverity(severity.High).
 						WithAttributeAnnotation(entryPointAttr).
 						WithRange(entryPointAttr.Range()))
 				}
diff --git a/internal/app/tfsec/rules/dig005.go b/internal/app/tfsec/rules/dig005.go
index f6c99dace..46a99b9dd 100644
--- a/internal/app/tfsec/rules/dig005.go
+++ b/internal/app/tfsec/rules/dig005.go
@@ -15,7 +15,7 @@ import (
 const DIGPublicReadAclOnSpacesBucket = "DIG005"
 const DIGPublicReadAclOnSpacesBucketDescription = "Spaces bucket or bucket object has public read acl set"
 const DIGPublicReadAclOnSpacesBucketImpact = "The contents of the space can be accessed publicly"
-const DIGPublicReadAclOnSpacesBucketResolution = "Applt more restrictive ACL"
+const DIGPublicReadAclOnSpacesBucketResolution = "Apply a more restrictive ACL"
 const DIGPublicReadAclOnSpacesBucketExplanation = `
 Space bucket and bucket object permissions should be set to deny public access unless explicitly required.
 `
@@ -70,7 +70,7 @@ func init() {
 		Provider:        provider.DigitalOceanProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"digitalocean_spaces_bucket", "digitalocean_spaces_bucket_object"},
-		DefaultSeverity: severity.Medium,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.HasChild("acl") {
@@ -78,7 +78,6 @@ func init() {
 				if aclAttr.Equals("public-read", block.IgnoreCase) {
 					set.Add(result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has a publicly readable acl.", resourceBlock.FullName())).
-						WithSeverity(severity.Medium).
 						WithAttributeAnnotation(aclAttr).
 						WithRange(aclAttr.Range()))
 				}
diff --git a/internal/app/tfsec/rules/dig006.go b/internal/app/tfsec/rules/dig006.go
index 2b3a57539..3f2b03211 100644
--- a/internal/app/tfsec/rules/dig006.go
+++ b/internal/app/tfsec/rules/dig006.go
@@ -63,13 +63,12 @@ func init() {
 		Provider:        provider.DigitalOceanProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"digitalocean_spaces_bucket"},
-		DefaultSeverity: severity.Medium, //TODO set the default severity
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("versioning") {
 				set.Add(result.New(resourceBlock).
 					WithDescription(fmt.Sprintf("Resource '%s' does not have versioning enabled.", resourceBlock.FullName())).
-					WithSeverity(severity.Medium).
 					WithRange(resourceBlock.Range()))
 
 				return
@@ -81,7 +80,6 @@ func init() {
 			if enabledAttr == nil || enabledAttr.IsFalse() {
 				set.Add(result.New(resourceBlock).
 					WithDescription(fmt.Sprintf("Resource '%s' has versioning specified, but it isn't enabled", resourceBlock.FullName())).
-					WithSeverity(severity.Medium).
 					WithAttributeAnnotation(enabledAttr).
 					WithRange(enabledAttr.Range()))
 
diff --git a/internal/app/tfsec/rules/dig007.go b/internal/app/tfsec/rules/dig007.go
index 206d65cff..d3832c7a2 100644
--- a/internal/app/tfsec/rules/dig007.go
+++ b/internal/app/tfsec/rules/dig007.go
@@ -57,7 +57,6 @@ func init() {
 				if forceDestroyAttr.IsTrue() {
 					set.Add(result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has versioning specified, but it isn't enabled", resourceBlock.FullName())).
-						WithSeverity(severity.Medium).
 						WithAttributeAnnotation(forceDestroyAttr).
 						WithRange(forceDestroyAttr.Range()))
 				}
diff --git a/internal/app/tfsec/rules/gcp001.go b/internal/app/tfsec/rules/gcp001.go
index 0a7f0c3d1..ca44a03a9 100644
--- a/internal/app/tfsec/rules/gcp001.go
+++ b/internal/app/tfsec/rules/gcp001.go
@@ -20,7 +20,7 @@ import (
 const GoogleUnencryptedDisk = "GCP001"
 const GoogleUnencryptedDiskDescription = "Encrypted compute disk with unmanaged keys."
 const GoogleUnencryptedDiskImpact = "Encryption of disk using unmanaged keys."
-const GoogleUnencryptedDiskResolution = "Enable encrytion using a customer-managed key."
+const GoogleUnencryptedDiskResolution = "Enable encryption using a customer-managed key."
 const GoogleUnencryptedDiskExplanation = `
 By default, Compute Engine encrypts all data at rest. Compute Engine handles and manages this encryption for you without any additional actions on your part.
 
@@ -65,8 +65,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a disk encrypted with an auto-generated key.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/gcp003.go b/internal/app/tfsec/rules/gcp003.go
index e2acd180c..30e326302 100644
--- a/internal/app/tfsec/rules/gcp003.go
+++ b/internal/app/tfsec/rules/gcp003.go
@@ -53,7 +53,7 @@ func init() {
 		Provider:        provider.GCPProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"google_compute_firewall"},
-		DefaultSeverity: severity.Medium,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if sourceRanges := resourceBlock.GetAttribute("source_ranges"); sourceRanges != nil {
@@ -61,8 +61,7 @@ func init() {
 					set.Add(
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' defines a fully open inbound firewall rule.", resourceBlock.FullName())).
-							WithRange(sourceRanges.Range()).
-							WithSeverity(severity.Medium),
+							WithRange(sourceRanges.Range()),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/gcp004.go b/internal/app/tfsec/rules/gcp004.go
index a56f76174..907bfdf6d 100644
--- a/internal/app/tfsec/rules/gcp004.go
+++ b/internal/app/tfsec/rules/gcp004.go
@@ -53,7 +53,7 @@ func init() {
 		Provider:        provider.GCPProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"google_compute_firewall"},
-		DefaultSeverity: severity.Medium,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if destinationRanges := resourceBlock.GetAttribute("destination_ranges"); destinationRanges != nil {
@@ -62,8 +62,7 @@ func init() {
 					set.Add(
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' defines a fully open outbound firewall rule.", resourceBlock.FullName())).
-							WithRange(destinationRanges.Range()).
-							WithSeverity(severity.Medium),
+							WithRange(destinationRanges.Range()),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/gcp005.go b/internal/app/tfsec/rules/gcp005.go
index c45f328f8..aab172ad0 100644
--- a/internal/app/tfsec/rules/gcp005.go
+++ b/internal/app/tfsec/rules/gcp005.go
@@ -67,8 +67,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a cluster with ABAC enabled. Disable and rely on RBAC instead. ", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/gcp006.go b/internal/app/tfsec/rules/gcp006.go
index a495a85ef..8393386f1 100644
--- a/internal/app/tfsec/rules/gcp006.go
+++ b/internal/app/tfsec/rules/gcp006.go
@@ -87,8 +87,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a cluster with node metadata exposed. node_metadata set to EXPOSE or UNSPECIFIED disables metadata concealment. ", resourceBlock.FullName())).
-						WithRange(nodeMetadata.Range()).
-						WithSeverity(severity.High),
+						WithRange(nodeMetadata.Range()),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/gcp007.go b/internal/app/tfsec/rules/gcp007.go
index cb08bbc7d..9f6d6232c 100644
--- a/internal/app/tfsec/rules/gcp007.go
+++ b/internal/app/tfsec/rules/gcp007.go
@@ -73,8 +73,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a cluster with legacy metadata endpoints enabled.", resourceBlock.FullName())).
-						WithRange(legacyMetadataAPI.Range()).
-						WithSeverity(severity.High),
+						WithRange(legacyMetadataAPI.Range()),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/gcp008.go b/internal/app/tfsec/rules/gcp008.go
index 9e57fafba..c854826f2 100644
--- a/internal/app/tfsec/rules/gcp008.go
+++ b/internal/app/tfsec/rules/gcp008.go
@@ -22,7 +22,7 @@ const GkeLegacyAuthEnabledDescription = "Legacy client authentication methods ut
 const GkeLegacyAuthEnabledImpact = "Username and password authentication methods are less secure"
 const GkeLegacyAuthEnabledResolution = "Use service account or OAuth for authentication"
 const GkeLegacyAuthEnabledExplanation = `
-It is recommended to use Serivce Accounts and OAuth as authentication methods for accessing the master in the container cluster. 
+It is recommended to use Service Accounts and OAuth as authentication methods for accessing the master in the container cluster. 
 
 Basic authentication should be disabled by explicitly unsetting the <code>username</code> and <code>password</code> on the <code>master_auth</code> block.
 `
@@ -75,8 +75,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not disable basic auth with static passwords for client authentication. Disable this with a master_auth block container empty strings for user and password.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -86,8 +85,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a cluster using basic auth with static passwords for client authentication. It is recommended to use OAuth or service accounts instead.", resourceBlock.FullName())).
-						WithRange(masterAuthBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(masterAuthBlock.Range()),
 				)
 			}
 
@@ -100,8 +98,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a cluster using basic auth with client certificates for authentication. This cert has no permissions if RBAC is enabled and ABAC is disabled. It is recommended to use OAuth or service accounts instead.", resourceBlock.FullName())).
-						WithRange(issueClientCert.Range()).
-						WithSeverity(severity.High),
+						WithRange(issueClientCert.Range()),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/gcp009.go b/internal/app/tfsec/rules/gcp009.go
index ad6c6cbe0..1597d29c0 100644
--- a/internal/app/tfsec/rules/gcp009.go
+++ b/internal/app/tfsec/rules/gcp009.go
@@ -69,8 +69,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a cluster with no Pod Security Policy config defined. It is recommended to define a PSP for your pods and enable PSP enforcement.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -80,8 +79,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a cluster with Pod Security Policy enforcement disabled. It is recommended to define a PSP for your pods and enable PSP enforcement.", resourceBlock.FullName())).
-						WithRange(enforcePSP.Range()).
-						WithSeverity(severity.High),
+						WithRange(enforcePSP.Range()),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/gcp010.go b/internal/app/tfsec/rules/gcp010.go
index df8422294..d3c4f8fab 100644
--- a/internal/app/tfsec/rules/gcp010.go
+++ b/internal/app/tfsec/rules/gcp010.go
@@ -60,8 +60,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a cluster with shielded nodes disabled. Shielded GKE Nodes provide strong, verifiable node identity and integrity to increase the security of GKE nodes and should be enabled on all GKE clusters.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -71,8 +70,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a cluster with shielded nodes disabled. Shielded GKE Nodes provide strong, verifiable node identity and integrity to increase the security of GKE nodes and should be enabled on all GKE clusters.", resourceBlock.FullName())).
-						WithRange(enableShieldedNodesAttr.Range()).
-						WithSeverity(severity.High),
+						WithRange(enableShieldedNodesAttr.Range()),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/gcp011.go b/internal/app/tfsec/rules/gcp011.go
index cd27e34e9..81ed7d609 100644
--- a/internal/app/tfsec/rules/gcp011.go
+++ b/internal/app/tfsec/rules/gcp011.go
@@ -118,8 +118,7 @@ func init() {
 					set.Add(
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("'%s' grants IAM to a user object. It is recommended to manage user permissions with groups.", resourceBlock.FullName())).
-							WithRange(attribute.Range()).
-							WithSeverity(severity.Medium),
+							WithRange(attribute.Range()),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/gcp012.go b/internal/app/tfsec/rules/gcp012.go
index 8c6e0669a..30412e4fe 100644
--- a/internal/app/tfsec/rules/gcp012.go
+++ b/internal/app/tfsec/rules/gcp012.go
@@ -57,7 +57,7 @@ func init() {
 		Provider:        provider.GCPProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"google_container_cluster", "google_container_node_pool"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if strings.HasPrefix(resourceBlock.Label(), "google_container_cluster") {
@@ -71,8 +71,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not define the node config and does not override the default service account. It is recommended to use a minimally privileged service account to run your GKE cluster.", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -84,8 +83,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not override the default service account. It is recommended to use a minimally privileged service account to run your GKE cluster.", resourceBlock.FullName())).
-						WithRange(nodeConfigBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(nodeConfigBlock.Range()),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/gcp013.go b/internal/app/tfsec/rules/gcp013.go
index dcbc6067d..06d379b9b 100644
--- a/internal/app/tfsec/rules/gcp013.go
+++ b/internal/app/tfsec/rules/gcp013.go
@@ -17,7 +17,7 @@ const GCPRawEncryptionKeySpecifiedForComputeDiskDescription = "The encryption ke
 const GCPRawEncryptionKeySpecifiedForComputeDiskImpact = "The encryption key should be considered compromised as it is not stored securely."
 const GCPRawEncryptionKeySpecifiedForComputeDiskResolution = "Reference a managed key rather than include the key in raw format."
 const GCPRawEncryptionKeySpecifiedForComputeDiskExplanation = `
-Sensitve values such as raw encryption keys should not be included in your Terraform code, and should be stored securely by a secrets manager.
+Sensitive values such as raw encryption keys should not be included in your Terraform code, and should be stored securely by a secrets manager.
 `
 const GCPRawEncryptionKeySpecifiedForComputeDiskBadExample = `
 resource "google_compute_disk" "good_example" {
@@ -52,7 +52,7 @@ func init() {
 		Provider:        provider.GCPProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"google_compute_disk"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			keyBlock := resourceBlock.GetBlock("disk_encryption_key")
@@ -70,8 +70,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' specifies an encryption key in raw format.", resourceBlock.FullName())).
 						WithRange(rawKeyAttr.Range()).
-						WithAttributeAnnotation(rawKeyAttr).
-						WithSeverity(severity.High),
+						WithAttributeAnnotation(rawKeyAttr),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/gen001.go b/internal/app/tfsec/rules/gen001.go
index 2bcf54f9d..2046f1c40 100644
--- a/internal/app/tfsec/rules/gen001.go
+++ b/internal/app/tfsec/rules/gen001.go
@@ -68,7 +68,7 @@ func init() {
 		},
 		Provider:        provider.GeneralProvider,
 		RequiredTypes:   []string{"variable"},
-		DefaultSeverity: severity.Medium,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if len(resourceBlock.Labels()) == 0 || !security.IsSensitiveAttribute(resourceBlock.TypeLabel()) {
@@ -81,8 +81,7 @@ func init() {
 						set.Add(result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Variable '%s' includes a potentially sensitive default value.", resourceBlock.FullName())).
 							WithRange(attribute.Range()).
-							WithAttributeAnnotation(attribute).
-							WithSeverity(severity.Medium),
+							WithAttributeAnnotation(attribute),
 						)
 					}
 				}
diff --git a/internal/app/tfsec/rules/gen002.go b/internal/app/tfsec/rules/gen002.go
index 8796162ed..d36ed6d44 100644
--- a/internal/app/tfsec/rules/gen002.go
+++ b/internal/app/tfsec/rules/gen002.go
@@ -60,7 +60,7 @@ func init() {
 		},
 		Provider:        provider.GeneralProvider,
 		RequiredTypes:   []string{"locals"},
-		DefaultSeverity: severity.Medium,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			for _, attribute := range resourceBlock.GetAttributes() {
@@ -69,8 +69,7 @@ func init() {
 						set.Add(result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Local '%s' includes a potentially sensitive value which is defined within the project.", resourceBlock.FullName())).
 							WithRange(attribute.Range()).
-							WithAttributeAnnotation(attribute).
-							WithSeverity(severity.Medium),
+							WithAttributeAnnotation(attribute),
 						)
 					}
 				}
diff --git a/internal/app/tfsec/rules/gen003.go b/internal/app/tfsec/rules/gen003.go
index 3153ba368..988924f37 100644
--- a/internal/app/tfsec/rules/gen003.go
+++ b/internal/app/tfsec/rules/gen003.go
@@ -87,7 +87,7 @@ func init() {
 		},
 		Provider:        provider.GeneralProvider,
 		RequiredTypes:   []string{"resource", "provider", "module"},
-		DefaultSeverity: severity.Medium,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			attributes := resourceBlock.GetAttributes()
@@ -104,8 +104,7 @@ func init() {
 						set.Add(result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Block '%s' includes a potentially sensitive attribute which is defined within the project.", resourceBlock.FullName())).
 							WithRange(attribute.Range()).
-							WithAttributeAnnotation(attribute).
-							WithSeverity(severity.Medium),
+							WithAttributeAnnotation(attribute),
 						)
 					}
 
diff --git a/internal/app/tfsec/rules/gen004.go b/internal/app/tfsec/rules/gen004.go
index 2b41141d9..f2a632fe8 100644
--- a/internal/app/tfsec/rules/gen004.go
+++ b/internal/app/tfsec/rules/gen004.go
@@ -20,7 +20,7 @@ import (
 const GENEnsureGithubRepositoryIsPrivate = "GEN004"
 const GENEnsureGithubRepositoryIsPrivateDescription = "Github repository shouldn't be public."
 const GENEnsureGithubRepositoryIsPrivateImpact = "Anyone can read the contents of the GitHub repository and leak IP"
-const GENEnsureGithubRepositoryIsPrivateResolution = "Make sensitive or commercially importnt repositories private"
+const GENEnsureGithubRepositoryIsPrivateResolution = "Make sensitive or commercially important repositories private"
 const GENEnsureGithubRepositoryIsPrivateExplanation = `
 Github repository should be set to be private.
 
@@ -72,7 +72,7 @@ func init() {
 		Provider:        provider.GeneralProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"github_repository"},
-		DefaultSeverity: severity.High,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			privateAttribute := resourceBlock.GetAttribute("private")
@@ -81,8 +81,7 @@ func init() {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' is missing both of `private` or `visibility` attributes - one of these is required to make repository private", resourceBlock.FullName())).
-						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(resourceBlock.Range()),
 				)
 				return
 			}
@@ -94,8 +93,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' has visibility set to public - visibility should be set to `private` or `internal` to make repository private", resourceBlock.FullName())).
 							WithRange(visibilityAttribute.Range()).
-							WithAttributeAnnotation(visibilityAttribute).
-							WithSeverity(severity.High),
+							WithAttributeAnnotation(visibilityAttribute),
 					)
 				}
 				// stop here as visibility parameter trumps the private one
@@ -109,8 +107,7 @@ func init() {
 					set.Add(
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' has private set to false - it should be set to `true` to make repository private", resourceBlock.FullName())).
-							WithRange(privateAttribute.Range()).
-							WithSeverity(severity.High),
+							WithRange(privateAttribute.Range()),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/gen005.go b/internal/app/tfsec/rules/gen005.go
index c06488b69..162fb9ce8 100644
--- a/internal/app/tfsec/rules/gen005.go
+++ b/internal/app/tfsec/rules/gen005.go
@@ -63,7 +63,7 @@ func init() {
 		Provider:        provider.GeneralProvider,
 		RequiredTypes:   []string{"resource", "provider", "module", "locals", "variable"},
 		RequiredLabels:  []string{"*"},
-		DefaultSeverity: severity.Medium,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			attributes := resourceBlock.GetAttributes()
@@ -75,8 +75,7 @@ func init() {
 							result.New(resourceBlock).
 								WithDescription(fmt.Sprintf("Block '%s' includes potentially sensitive data. %s", resourceBlock.FullName(), scanResult.Description)).
 								WithRange(attribute.Range()).
-								WithAttributeAnnotation(attribute).
-								WithSeverity(severity.Medium),
+								WithAttributeAnnotation(attribute),
 						)
 					}
 				}
diff --git a/internal/app/tfsec/rules/oci001.go b/internal/app/tfsec/rules/oci001.go
index 71f8ded3c..a8cf0cb19 100644
--- a/internal/app/tfsec/rules/oci001.go
+++ b/internal/app/tfsec/rules/oci001.go
@@ -57,7 +57,7 @@ func init() {
 		Provider:        provider.OracleProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"opc_compute_ip_address_reservation"},
-		DefaultSeverity: severity.Medium,
+		DefaultSeverity: severity.Critical,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			if attr := resourceBlock.GetAttribute("ip_address_pool"); attr != nil {
 				if attr.Equals("public-ippool") {
@@ -65,8 +65,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' is using an IP from a public IP pool", resourceBlock.FullName())).
 							WithRange(attr.Range()).
-							WithAttributeAnnotation(attr).
-							WithSeverity(severity.Medium),
+							WithAttributeAnnotation(attr),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/scanner/scanner.go b/internal/app/tfsec/scanner/scanner.go
index da602241d..aab190522 100644
--- a/internal/app/tfsec/scanner/scanner.go
+++ b/internal/app/tfsec/scanner/scanner.go
@@ -69,9 +69,9 @@ func (scanner *Scanner) Scan(blocks []block.Block) []result.Result {
 							WithDescription(fmt.Sprintf("Resource '%s' passed check: %s", checkBlock.FullName(), r.Documentation.Summary)).
 							WithRange(checkBlock.Range()).
 							WithStatus(result.Passed).
-							WithSeverity(r.DefaultSeverity).
 							WithImpact(r.Documentation.Impact).
-							WithResolution(r.Documentation.Resolution)
+							WithResolution(r.Documentation.Resolution).
+							WithSeverity(r.DefaultSeverity)
 						results = append(results, *res)
 					} else if ruleResults != nil {
 						for _, ruleResult := range ruleResults.All() {


Test patch:
diff --git a/internal/app/tfsec/funcs/collection_test.go b/internal/app/tfsec/funcs/collection_test.go
index 27898e9bd..15b134250 100644
--- a/internal/app/tfsec/funcs/collection_test.go
+++ b/internal/app/tfsec/funcs/collection_test.go
@@ -807,7 +807,7 @@ func TestLookup(t *testing.T) {
 			cty.StringVal("beep").Mark("a"),
 			false,
 		},
-		{ // apply collection marks to unknown return vaue
+		{ // apply collection marks to unknown return value
 			[]cty.Value{
 				cty.MapVal(map[string]cty.Value{
 					"boop": cty.StringVal("beep"),
diff --git a/internal/app/tfsec/test/aws060_test.go b/internal/app/tfsec/test/aws060_test.go
index a5f89e34e..a03e7d475 100644
--- a/internal/app/tfsec/test/aws060_test.go
+++ b/internal/app/tfsec/test/aws060_test.go
@@ -15,7 +15,7 @@ func Test_AWSAthenaWorkgroupEnforceConfiguration(t *testing.T) {
 		mustExcludeResultCode string
 	}{
 		{
-			name: "test athena workgroup with configration but enforce set to false",
+			name: "test athena workgroup with configuration but enforce set to false",
 			source: `
 resource "aws_athena_workgroup" "good_example" {
   name = "example"
diff --git a/internal/app/tfsec/test/aws080_test.go b/internal/app/tfsec/test/aws080_test.go
index 455057453..9a274e67a 100644
--- a/internal/app/tfsec/test/aws080_test.go
+++ b/internal/app/tfsec/test/aws080_test.go
@@ -128,7 +128,7 @@ resource "aws_codebuild_project" "codebuild" {
 `, t)
 		for _, result := range results {
 			if result.RuleID == rules.AWSCodeBuildProjectEncryptionNotDisabled {
-				assert.True(t, result.Severity == severity.Medium, fmt.Sprintf("Result with code '%s' had wrong Severity reported '%s'", result.RuleID, result.Severity))
+				assert.True(t, result.Severity == severity.High, fmt.Sprintf("Result with code '%s' had wrong Severity reported '%s'", result.RuleID, result.Severity))
 			}
 		}
 	})
diff --git a/internal/app/tfsec/test/ignore_test.go b/internal/app/tfsec/test/ignore_test.go
index f51a1b404..45c3ded71 100644
--- a/internal/app/tfsec/test/ignore_test.go
+++ b/internal/app/tfsec/test/ignore_test.go
@@ -74,7 +74,7 @@ func Test_IgnoreSpecific(t *testing.T) {
 		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			set.Add(
-				result.New(resourceBlock).WithDescription("example problem").WithRange(resourceBlock.Range()).WithSeverity(severity.High),
+				result.New(resourceBlock).WithDescription("example problem").WithRange(resourceBlock.Range()),
 			)
 		},
 	})
@@ -85,7 +85,7 @@ func Test_IgnoreSpecific(t *testing.T) {
 		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			set.Add(
-				result.New(resourceBlock).WithDescription("example problem").WithRange(resourceBlock.Range()).WithSeverity(severity.High),
+				result.New(resourceBlock).WithDescription("example problem").WithRange(resourceBlock.Range()),
 			)
 		},
 	})
diff --git a/internal/app/tfsec/test/setup_test.go b/internal/app/tfsec/test/setup_test.go
index c53dbb60d..6efda1c36 100644
--- a/internal/app/tfsec/test/setup_test.go
+++ b/internal/app/tfsec/test/setup_test.go
@@ -53,7 +53,7 @@ resource "problem" "x" {
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			if resourceBlock.GetAttribute("bad") != nil {
 				set.Add(
-					result.New(resourceBlock).WithDescription("example problem").WithRange(resourceBlock.Range()).WithSeverity(severity.High),
+					result.New(resourceBlock).WithDescription("example problem").WithRange(resourceBlock.Range()),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/test/wildcard_test.go b/internal/app/tfsec/test/wildcard_test.go
index 7711ac556..a60272881 100644
--- a/internal/app/tfsec/test/wildcard_test.go
+++ b/internal/app/tfsec/test/wildcard_test.go
@@ -66,8 +66,7 @@ func Test_WildcardMatchingOnRequiredLabels(t *testing.T) {
 			CheckFunc: func(set result.Set, rootBlock block.Block, ctx *hclcontext.Context) {
 				set.Add(
 					result.New(rootBlock).WithDescription(fmt.Sprintf("Custom check failed for resource %s.", rootBlock.FullName())).
-						WithRange(rootBlock.Range()).
-						WithSeverity(severity.High),
+						WithRange(rootBlock.Range()),
 				)
 			},
 		})