Repository: aquasecurity/tfsec
Pull request #857 (2021-07-13 09:09:34)

Switch rules severity to fit in with Trivy
Rewrite the config as it's read to be backward compatible with existing
configurations



Patch:
diff --git a/cmd/tfsec/main.go b/cmd/tfsec/main.go
index c658597c7..b0d036abd 100644
--- a/cmd/tfsec/main.go
+++ b/cmd/tfsec/main.go
@@ -163,7 +163,7 @@ var rootCmd = &cobra.Command{
 		debug.Log("custom check directory set to %s", customCheckDir)
 		err = custom.Load(customCheckDir)
 		if err != nil {
-			_, _ = fmt.Fprint(os.Stderr, fmt.Sprintf("There were errors while processing custom check files. %s", err))
+			_, _ = fmt.Fprintf(os.Stderr, "There were errors while processing custom check files. %s", err)
 			os.Exit(1)
 		}
 		debug.Log("Custom checks loaded")
@@ -243,7 +243,7 @@ var rootCmd = &cobra.Command{
 			os.Exit(getDetailedExitCode(results))
 		}
 
-		// If all failed rules are of INFO severity, then produce a success
+		// If all failed rules are of LOW severity, then produce a success
 		// exit code (0).
 		if allInfo(results) {
 			return nil
@@ -284,13 +284,13 @@ func getDetailedExitCode(results []result.Result) int {
 		return 0
 	}
 
-	// If there are some failed rules but they are all of INFO severity, then
+	// If there are some failed rules but they are all of LOW severity, then
 	// produce a special failure exit code (2).
 	if allInfo(results) {
 		return 2
 	}
 
-	// If there is any failed check of ERROR or WARNING severity, then
+	// If there is any failed check of HIGH or WARNING severity, then
 	// produce the regular failure exit code (1).
 	return 1
 }
@@ -308,11 +308,11 @@ func RemoveDuplicatesAndUnwanted(results []result.Result, ignoreWarnings bool, e
 			continue
 		}
 
-		if ignoreWarnings && res.Severity == severity.Warning {
+		if ignoreWarnings && res.Severity == severity.Medium {
 			continue
 		}
 
-		if ignoreInfo && res.Severity == severity.Info {
+		if ignoreInfo && res.Severity == severity.Low {
 			continue
 		}
 
@@ -367,7 +367,7 @@ func mergeWithoutDuplicates(left, right []string) []string {
 
 func allInfo(results []result.Result) bool {
 	for _, res := range results {
-		if res.Severity != severity.Info && res.Status != result.Passed && res.Status != result.Ignored {
+		if res.Severity != severity.Low && res.Status != result.Passed && res.Status != result.Ignored {
 			return false
 		}
 	}
diff --git a/example/custom/.tfsec/custom_tf_checks.json b/example/custom/.tfsec/custom_tf_checks.json
index 4f0f7cb67..d19af57fe 100644
--- a/example/custom/.tfsec/custom_tf_checks.json
+++ b/example/custom/.tfsec/custom_tf_checks.json
@@ -9,7 +9,7 @@
       "requiredLabels": [
         "aws_instance"
       ],
-      "severity": "ERROR",
+      "severity": "HIGH",
       "matchSpec": {
         "name": "tags",
         "action": "contains",
@@ -34,9 +34,9 @@
         "name": "versioning",
         "action": "isPresent",
         "subMatch": {
-          "name" : "enabled",
+          "name": "enabled",
           "action": "equals",
-          "value" : "true"
+          "value": "true"
         }
       },
       "errorMessage": "The versioning block requires enabled attribute",
@@ -53,10 +53,13 @@
       "requiredLabels": [
         "aws_s3_bucket"
       ],
-      "severity": "ERROR",
+      "severity": "HIGH",
       "matchSpec": {
         "name": "acl",
-        "value": ["public-read", "authenticated-users"],
+        "value": [
+          "public-read",
+          "authenticated-users"
+        ],
         "action": "isNone"
       },
       "errorMessage": "The ACL must not be one of ['public-read', 'authenticated-users']",
@@ -73,7 +76,7 @@
       "requiredLabels": [
         "aws_s3_bucket"
       ],
-      "severity": "ERROR",
+      "severity": "HIGH",
       "matchSpec": {
         "action": "inModule"
       },
@@ -91,7 +94,7 @@
       "requiredLabels": [
         "*"
       ],
-      "severity": "ERROR",
+      "severity": "HIGH",
       "matchSpec": {
         "name": "source",
         "action": "regexMatches",
@@ -116,10 +119,13 @@
       "requiredLabels": [
         "aws_instance"
       ],
-      "severity": "ERROR",
+      "severity": "HIGH",
       "matchSpec": {
         "name": "ami",
-        "value": ["ami-1234", "ami-5678"],
+        "value": [
+          "ami-1234",
+          "ami-5678"
+        ],
         "action": "isAny"
       },
       "errorMessage": "The ec2 instance has an ami that isn't in the permitted range ['ami-1234', 'ami-5678']",
@@ -136,7 +142,7 @@
       "requiredLabels": [
         "aws_instance"
       ],
-      "severity": "ERROR",
+      "severity": "HIGH",
       "matchSpec": {
         "name": "cpu_core_count",
         "value": 2,
diff --git a/example/custom/.tfsec/custom_tfchecks.yaml b/example/custom/.tfsec/custom_tfchecks.yaml
index 25fc2151b..118203a71 100644
--- a/example/custom/.tfsec/custom_tfchecks.yaml
+++ b/example/custom/.tfsec/custom_tfchecks.yaml
@@ -6,7 +6,7 @@ checks:
       - resource
     requiredLabels:
       - aws_instance
-    severity: ERROR
+    severity: HIGH
     matchSpec:
       name: tags
       action: contains
@@ -37,7 +37,7 @@ checks:
       - resource
     requiredLabels:
       - aws_s3_bucket
-    severity: ERROR
+    severity: HIGH
     matchSpec:
       name: acl
       value:
@@ -54,7 +54,7 @@ checks:
       - resource
     requiredLabels:
       - aws_s3_bucket
-    severity: ERROR
+    severity: HIGH
     matchSpec:
       action: inModule
     errorMessage: S3 buckets must only be created using the custom bucket module
@@ -67,7 +67,7 @@ checks:
       - module
     requiredLabels:
       - "*"
-    severity: ERROR
+    severity: HIGH
     matchSpec:
       name: source
       action: regexMatches
@@ -86,7 +86,7 @@ checks:
       - resource
     requiredLabels:
       - aws_instance
-    severity: ERROR
+    severity: HIGH
     matchSpec:
       name: ami
       value:
@@ -103,7 +103,7 @@ checks:
       - resource
     requiredLabels:
       - aws_instance
-    severity: ERROR
+    severity: HIGH
     matchSpec:
       name: cpu_core_count
       value: 2
diff --git a/example/custom/tfsec.json b/example/custom/tfsec.json
index 7624531c2..04dc09a3d 100644
--- a/example/custom/tfsec.json
+++ b/example/custom/tfsec.json
@@ -1,6 +1,6 @@
 {
   "severity_overrides": {
-    "CUS002": "ERROR",
+    "CUS002": "HIGH",
     "AWS025": "WARNING"
   }
 }
\ No newline at end of file
diff --git a/example/custom/tfsec.yaml b/example/custom/tfsec.yaml
index bcd15a506..251416b43 100644
--- a/example/custom/tfsec.yaml
+++ b/example/custom/tfsec.yaml
@@ -1,4 +1,4 @@
 ---
 severity_overrides:
-  CUS002: ERROR
-  AWS025: INFO
\ No newline at end of file
+  CUS002: HIGH
+  AWS025: LOW
\ No newline at end of file
diff --git a/example/custom_functions/.tfsec/functions_tfchecks.yaml b/example/custom_functions/.tfsec/functions_tfchecks.yaml
index a59bd0ba3..7a3bbf8af 100644
--- a/example/custom_functions/.tfsec/functions_tfchecks.yaml
+++ b/example/custom_functions/.tfsec/functions_tfchecks.yaml
@@ -17,6 +17,6 @@ checks:
           
     requiredTypes:
     - resource
-    severity: ERROR
+    severity: HIGH
     requiredLabels:
     - aws_lb
\ No newline at end of file
diff --git a/internal/app/tfsec/config/config.go b/internal/app/tfsec/config/config.go
index 496699db3..7ef04cab7 100644
--- a/internal/app/tfsec/config/config.go
+++ b/internal/app/tfsec/config/config.go
@@ -44,5 +44,27 @@ func LoadConfig(configFilePath string) (*Config, error) {
 		return nil, fmt.Errorf("couldn't process the file %s", configFilePath)
 	}
 
+	rewriteSeverityOverrides(config)
+
 	return config, nil
 }
+
+func rewriteSeverityOverrides(config *Config) error {
+
+	for k, s := range config.SeverityOverrides {
+		switch strings.ToUpper(s) {
+		case "CRITICAL", "HIGH", "MEDIUM", "LOW":
+			continue
+		case "ERROR":
+			config.SeverityOverrides[k] = "HIGH"
+		case "WARNING":
+			config.SeverityOverrides[k] = "MEDIUM"
+		case "INFO":
+			config.SeverityOverrides[k] = "LOW"
+		default:
+			return fmt.Errorf("could not rewrite the severity code [%s]", s)
+		}
+	}
+
+	return nil
+}
diff --git a/internal/app/tfsec/custom/processing.go b/internal/app/tfsec/custom/processing.go
index 35f7f558e..910e8d1fb 100644
--- a/internal/app/tfsec/custom/processing.go
+++ b/internal/app/tfsec/custom/processing.go
@@ -133,7 +133,7 @@ func processFoundChecks(checks ChecksFile) {
 				Provider:        provider.CustomProvider,
 				RequiredTypes:   customCheck.RequiredTypes,
 				RequiredLabels:  customCheck.RequiredLabels,
-				DefaultSeverity: severity.Warning,
+				DefaultSeverity: severity.Medium,
 				CheckFunc: func(set result.Set, rootBlock block.Block, ctx *hclcontext.Context) {
 					matchSpec := customCheck.MatchSpec
 					if !evalMatchSpec(rootBlock, matchSpec, ctx) {
diff --git a/internal/app/tfsec/formatters/default.go b/internal/app/tfsec/formatters/default.go
index acd0b1036..f4c802f02 100644
--- a/internal/app/tfsec/formatters/default.go
+++ b/internal/app/tfsec/formatters/default.go
@@ -19,10 +19,10 @@ import (
 )
 
 var severityFormat = map[severity.Severity]string{
-	severity.Info:    tml.Sprintf("<white>%s</white>", severity.Info),
-	severity.Warning: tml.Sprintf("<yellow>%s</yellow>", severity.Warning),
-	severity.Error:   tml.Sprintf("<red>%s</red>", severity.Error),
-	"":               tml.Sprintf("<white>%s</white>", severity.Info),
+	severity.Low:    tml.Sprintf("<white>%s</white>", severity.Low),
+	severity.Medium: tml.Sprintf("<yellow>%s</yellow>", severity.Medium),
+	severity.High:   tml.Sprintf("<red>%s</red>", severity.High),
+	"":              tml.Sprintf("<white>%s</white>", severity.Low),
 }
 
 func FormatDefault(_ io.Writer, results []result.Result, _ string, options ...FormatterOption) error {
diff --git a/internal/app/tfsec/formatters/sarif.go b/internal/app/tfsec/formatters/sarif.go
index f8f784d43..7995762db 100644
--- a/internal/app/tfsec/formatters/sarif.go
+++ b/internal/app/tfsec/formatters/sarif.go
@@ -45,11 +45,11 @@ func FormatSarif(w io.Writer, results []result.Result, baseDir string, _ ...Form
 		switch res.Severity {
 		case severity.None:
 			level = "none"
-		case severity.Info:
+		case severity.Low:
 			level = "note"
-		case severity.Warning:
+		case severity.Medium:
 			level = "warning"
-		case severity.Error, severity.Critical:
+		case severity.High, severity.Critical:
 			level = "error"
 		}
 
diff --git a/internal/app/tfsec/rules/aws001.go b/internal/app/tfsec/rules/aws001.go
index c7050569e..5c8f5213c 100644
--- a/internal/app/tfsec/rules/aws001.go
+++ b/internal/app/tfsec/rules/aws001.go
@@ -57,7 +57,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_s3_bucket"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			if attr := resourceBlock.GetAttribute("acl"); attr != nil {
 				if attr.IsAny("public-read", "public-read-write", "website") {
@@ -66,14 +66,14 @@ func init() {
 							WithDescription(fmt.Sprintf("Resource '%s' has an ACL which allows public access.", resourceBlock.FullName())).
 							WithAttributeAnnotation(attr).
 							WithRange(attr.Range()).
-							WithSeverity(severity.Warning),
+							WithSeverity(severity.Medium),
 					)
 				} else if attr.Equals("authenticated-read") {
 					set.Add(
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' has an ACL which allows access to any authenticated AWS user, not just users within the target account.", resourceBlock.FullName())).
 							WithRange(attr.Range()).
-							WithSeverity(severity.Warning),
+							WithSeverity(severity.Medium),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws002.go b/internal/app/tfsec/rules/aws002.go
index 5297c61ee..80e9da12e 100644
--- a/internal/app/tfsec/rules/aws002.go
+++ b/internal/app/tfsec/rules/aws002.go
@@ -55,7 +55,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_s3_bucket"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			if loggingBlock := resourceBlock.GetBlock("logging"); loggingBlock == nil {
 				if resourceBlock.GetAttribute("acl") != nil && resourceBlock.GetAttribute("acl").Equals("log-delivery-write") {
@@ -65,7 +65,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not have logging enabled.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws003.go b/internal/app/tfsec/rules/aws003.go
index fbb730e76..028361363 100644
--- a/internal/app/tfsec/rules/aws003.go
+++ b/internal/app/tfsec/rules/aws003.go
@@ -53,13 +53,13 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_db_security_group", "aws_redshift_security_group", "aws_elasticache_security_group"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			set.Add(
 				result.New(resourceBlock).
 					WithDescription(fmt.Sprintf("Resource '%s' uses EC2 Classic. Use a VPC instead.", resourceBlock.FullName())).
 					WithRange(resourceBlock.Range()).
-					WithSeverity(severity.Error),
+					WithSeverity(severity.High),
 			)
 		},
 	})
diff --git a/internal/app/tfsec/rules/aws004.go b/internal/app/tfsec/rules/aws004.go
index d0dae3ef9..9c02e1325 100644
--- a/internal/app/tfsec/rules/aws004.go
+++ b/internal/app/tfsec/rules/aws004.go
@@ -56,7 +56,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_lb_listener", "aws_alb_listener"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, ctx *hclcontext.Context) {
 			// didn't find the referenced block, log and move on
 			if checkIfExempt(resourceBlock, ctx) {
@@ -82,7 +82,7 @@ func init() {
 
 			res := result.New(resourceBlock).
 				WithDescription(fmt.Sprintf("Resource '%s' uses plain HTTP instead of HTTPS.", resourceBlock.FullName())).
-				WithSeverity(severity.Error).
+				WithSeverity(severity.High).
 				WithRange(resourceBlock.Range())
 
 			if protocolAttr != nil {
diff --git a/internal/app/tfsec/rules/aws005.go b/internal/app/tfsec/rules/aws005.go
index 56b3c43d4..9bbd2f1e2 100644
--- a/internal/app/tfsec/rules/aws005.go
+++ b/internal/app/tfsec/rules/aws005.go
@@ -54,7 +54,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_alb", "aws_elb", "aws_lb"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			if resourceBlock.HasChild("load_balancer_type") && resourceBlock.GetAttribute("load_balancer_type").Equals("gateway") {
 				return
@@ -64,7 +64,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' is exposed publicly.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 			} else if internalAttr.Type() == cty.Bool && internalAttr.Value().False() {
 				set.Add(
@@ -72,7 +72,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' is exposed publicly.", resourceBlock.FullName())).
 						WithRange(internalAttr.Range()).
 						WithAttributeAnnotation(internalAttr).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws006.go b/internal/app/tfsec/rules/aws006.go
index f37a46502..98332409b 100644
--- a/internal/app/tfsec/rules/aws006.go
+++ b/internal/app/tfsec/rules/aws006.go
@@ -56,7 +56,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_security_group_rule"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			typeAttr := resourceBlock.GetAttribute("type")
@@ -75,7 +75,7 @@ func init() {
 							WithDescription(fmt.Sprintf("Resource '%s' defines a fully open ingress security group rule.", resourceBlock.FullName())).
 							WithAttributeAnnotation(cidrBlocksAttr).
 							WithRange(cidrBlocksAttr.Range()).
-							WithSeverity(severity.Warning),
+							WithSeverity(severity.Medium),
 					)
 				}
 			}
@@ -87,7 +87,7 @@ func init() {
 							WithDescription(fmt.Sprintf("Resource '%s' defines a fully open ingress security group rule.", resourceBlock.FullName())).
 							WithRange(ipv6CidrBlocksAttr.Range()).
 							WithAttributeAnnotation(ipv6CidrBlocksAttr).
-							WithSeverity(severity.Warning),
+							WithSeverity(severity.Medium),
 					)
 				}
 
diff --git a/internal/app/tfsec/rules/aws007.go b/internal/app/tfsec/rules/aws007.go
index 7c2784fc0..a6959dbfd 100644
--- a/internal/app/tfsec/rules/aws007.go
+++ b/internal/app/tfsec/rules/aws007.go
@@ -56,7 +56,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_security_group_rule"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			typeAttr := resourceBlock.GetAttribute("type")
@@ -76,7 +76,7 @@ func init() {
 							WithDescription(fmt.Sprintf("Resource '%s' defines a fully open egress security group rule.", resourceBlock.FullName())).
 							WithRange(cidrBlocksAttr.Range()).
 							WithAttributeAnnotation(cidrBlocksAttr).
-							WithSeverity(severity.Warning),
+							WithSeverity(severity.Medium),
 					)
 				}
 			}
@@ -89,7 +89,7 @@ func init() {
 							WithDescription(fmt.Sprintf("Resource '%s' defines a fully open egress security group rule.", resourceBlock.FullName())).
 							WithRange(ipv6CidrBlocksAttr.Range()).
 							WithAttributeAnnotation(ipv6CidrBlocksAttr).
-							WithSeverity(severity.Warning),
+							WithSeverity(severity.Medium),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws008.go b/internal/app/tfsec/rules/aws008.go
index 227762d57..12ed9f1fd 100644
--- a/internal/app/tfsec/rules/aws008.go
+++ b/internal/app/tfsec/rules/aws008.go
@@ -56,7 +56,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_security_group"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(resultSet result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			for _, directionBlock := range resourceBlock.GetBlocks("ingress") {
@@ -68,7 +68,7 @@ func init() {
 								WithDescription(fmt.Sprintf("Resource '%s' defines a fully open ingress security group.", resourceBlock.FullName())).
 								WithRange(cidrBlocksAttr.Range()).
 								WithAttributeAnnotation(cidrBlocksAttr).
-								WithSeverity(severity.Warning),
+								WithSeverity(severity.Medium),
 						)
 					}
 				}
@@ -80,7 +80,7 @@ func init() {
 							result.New(resourceBlock).
 								WithDescription(fmt.Sprintf("Resource '%s' defines a fully open ingress security group.", resourceBlock.FullName())).
 								WithRange(cidrBlocksAttr.Range()).
-								WithSeverity(severity.Warning),
+								WithSeverity(severity.Medium),
 						)
 					}
 				}
diff --git a/internal/app/tfsec/rules/aws009.go b/internal/app/tfsec/rules/aws009.go
index ce58851a4..9af82d6f5 100644
--- a/internal/app/tfsec/rules/aws009.go
+++ b/internal/app/tfsec/rules/aws009.go
@@ -56,7 +56,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_security_group"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			for _, directionBlock := range resourceBlock.GetBlocks("egress") {
@@ -68,7 +68,7 @@ func init() {
 								WithDescription(fmt.Sprintf("Resource '%s' defines a fully open egress security group.", resourceBlock.FullName())).
 								WithRange(cidrBlocksAttr.Range()).
 								WithAttributeAnnotation(cidrBlocksAttr).
-								WithSeverity(severity.Warning),
+								WithSeverity(severity.Medium),
 						)
 					}
 				}
@@ -81,7 +81,7 @@ func init() {
 								WithDescription(fmt.Sprintf("Resource '%s' defines a fully open egress security group.", resourceBlock.FullName())).
 								WithRange(cidrBlocksAttr.Range()).
 								WithAttributeAnnotation(cidrBlocksAttr).
-								WithSeverity(severity.Warning),
+								WithSeverity(severity.Medium),
 						)
 					}
 				}
diff --git a/internal/app/tfsec/rules/aws010.go b/internal/app/tfsec/rules/aws010.go
index 6af3ec56e..12fa111ef 100644
--- a/internal/app/tfsec/rules/aws010.go
+++ b/internal/app/tfsec/rules/aws010.go
@@ -63,7 +63,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_lb_listener", "aws_alb_listener"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if sslPolicyAttr := resourceBlock.GetAttribute("ssl_policy"); sslPolicyAttr != nil && sslPolicyAttr.Type() == cty.String {
@@ -74,7 +74,7 @@ func init() {
 								WithDescription(fmt.Sprintf("Resource '%s' is using an outdated SSL policy.", resourceBlock.FullName())).
 								WithRange(sslPolicyAttr.Range()).
 								WithAttributeAnnotation(sslPolicyAttr).
-								WithSeverity(severity.Error),
+								WithSeverity(severity.High),
 						)
 					}
 				}
diff --git a/internal/app/tfsec/rules/aws011.go b/internal/app/tfsec/rules/aws011.go
index 61bea447c..d1dee51ed 100644
--- a/internal/app/tfsec/rules/aws011.go
+++ b/internal/app/tfsec/rules/aws011.go
@@ -54,7 +54,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_db_instance", "aws_dms_replication_instance", "aws_rds_cluster_instance", "aws_redshift_cluster"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if publicAttr := resourceBlock.GetAttribute("publicly_accessible"); publicAttr != nil && publicAttr.Type() == cty.Bool {
@@ -64,7 +64,7 @@ func init() {
 							WithDescription(fmt.Sprintf("Resource '%s' is exposed publicly.", resourceBlock.FullName())).
 							WithRange(publicAttr.Range()).
 							WithAttributeAnnotation(publicAttr).
-							WithSeverity(severity.Warning),
+							WithSeverity(severity.Medium),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws012.go b/internal/app/tfsec/rules/aws012.go
index 5b63b46ec..4ba803ef2 100644
--- a/internal/app/tfsec/rules/aws012.go
+++ b/internal/app/tfsec/rules/aws012.go
@@ -56,7 +56,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_launch_configuration", "aws_instance"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if publicAttr := resourceBlock.GetAttribute("associate_public_ip_address"); publicAttr != nil && publicAttr.Type() == cty.Bool {
@@ -66,7 +66,7 @@ func init() {
 							WithDescription(fmt.Sprintf("Resource '%s' has a public IP address associated.", resourceBlock.FullName())).
 							WithRange(publicAttr.Range()).
 							WithAttributeAnnotation(publicAttr).
-							WithSeverity(severity.Error),
+							WithSeverity(severity.High),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws013.go b/internal/app/tfsec/rules/aws013.go
index 374475644..4103089d0 100644
--- a/internal/app/tfsec/rules/aws013.go
+++ b/internal/app/tfsec/rules/aws013.go
@@ -84,7 +84,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_ecs_task_definition"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if definitionsAttr := resourceBlock.GetAttribute("container_definitions"); definitionsAttr != nil && definitionsAttr.Type() == cty.String {
@@ -109,7 +109,7 @@ func init() {
 								WithDescription(fmt.Sprintf("Resource '%s' includes a potentially sensitive environment variable '%s' in the container definition.", resourceBlock.FullName(), env.Name)).
 								WithRange(definitionsAttr.Range()).
 								WithAttributeAnnotation(definitionsAttr).
-								WithSeverity(severity.Warning),
+								WithSeverity(severity.Medium),
 							)
 						}
 					}
diff --git a/internal/app/tfsec/rules/aws014.go b/internal/app/tfsec/rules/aws014.go
index 0db5e8ef9..99c8782de 100644
--- a/internal/app/tfsec/rules/aws014.go
+++ b/internal/app/tfsec/rules/aws014.go
@@ -59,7 +59,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_launch_configuration"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, context *hclcontext.Context) {
 
 			var encryptionByDefault bool
@@ -77,7 +77,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' uses an unencrypted root EBS block device. Consider adding <blue>root_block_device{ encrypted = true }</blue>", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			} else if rootDeviceBlock != nil {
 				checkDeviceEncryption(rootDeviceBlock, encryptionByDefault, set, resourceBlock)
@@ -99,7 +99,7 @@ func checkDeviceEncryption(deviceBlock block.Block, encryptionByDefault bool, se
 			result.New(resourceBlock).
 				WithDescription(fmt.Sprintf("Resource '%s' uses an unencrypted EBS block device. Consider adding <blue>encrypted = true</blue>", resourceBlock.FullName())).
 				WithRange(deviceBlock.Range()).
-				WithSeverity(severity.Error),
+				WithSeverity(severity.High),
 		)
 	} else if encryptedAttr != nil && encryptedAttr.Type() == cty.Bool && encryptedAttr.Value().False() {
 		set.Add(
@@ -107,7 +107,7 @@ func checkDeviceEncryption(deviceBlock block.Block, encryptionByDefault bool, se
 				WithDescription(fmt.Sprintf("Resource '%s' uses an unencrypted root EBS block device.", resourceBlock.FullName())).
 				WithRange(encryptedAttr.Range()).
 				WithAttributeAnnotation(encryptedAttr).
-				WithSeverity(severity.Error),
+				WithSeverity(severity.High),
 		)
 	}
 }
diff --git a/internal/app/tfsec/rules/aws015.go b/internal/app/tfsec/rules/aws015.go
index 6cfd95028..6bc75ad78 100644
--- a/internal/app/tfsec/rules/aws015.go
+++ b/internal/app/tfsec/rules/aws015.go
@@ -55,7 +55,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_sqs_queue"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, context *hclcontext.Context) {
 
 			kmsKeyIDAttr := resourceBlock.GetAttribute("kms_master_key_id")
@@ -64,7 +64,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted SQS queue.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 
 			} else if kmsKeyIDAttr.Type() == cty.String && kmsKeyIDAttr.Value().AsString() == "" {
@@ -73,7 +73,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted SQS queue.", resourceBlock.FullName())).
 						WithRange(kmsKeyIDAttr.Range()).
 						WithAttributeAnnotation(kmsKeyIDAttr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws016.go b/internal/app/tfsec/rules/aws016.go
index 86699094f..f30cc76dc 100644
--- a/internal/app/tfsec/rules/aws016.go
+++ b/internal/app/tfsec/rules/aws016.go
@@ -55,7 +55,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_sns_topic"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, ctx *hclcontext.Context) {
 
 			kmsKeyIDAttr := resourceBlock.GetAttribute("kms_master_key_id")
@@ -64,7 +64,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted SNS topic.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			} else if kmsKeyIDAttr.Type() == cty.String && kmsKeyIDAttr.Value().AsString() == "" {
@@ -73,7 +73,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted SNS topic.", resourceBlock.FullName())).
 						WithRange(kmsKeyIDAttr.Range()).
 						WithAttributeAnnotation(kmsKeyIDAttr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -92,7 +92,7 @@ func init() {
 							WithDescription(fmt.Sprintf("Resource '%s' explicitly uses the default CMK", resourceBlock.FullName())).
 							WithRange(kmsKeyIDAttr.Range()).
 							WithAttributeAnnotation(kmsKeyIDAttr).
-							WithSeverity(severity.Warning),
+							WithSeverity(severity.Medium),
 					)
 				}
 
diff --git a/internal/app/tfsec/rules/aws017.go b/internal/app/tfsec/rules/aws017.go
index 469c56b03..26a1a9c27 100644
--- a/internal/app/tfsec/rules/aws017.go
+++ b/internal/app/tfsec/rules/aws017.go
@@ -62,7 +62,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_s3_bucket"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, context *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("server_side_encryption_configuration") {
@@ -70,7 +70,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted S3 bucket (missing server_side_encryption_configuration block).", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -80,7 +80,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted S3 bucket (missing rule block).", resourceBlock.FullName())).
 						WithRange(encryptionBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -91,7 +91,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted S3 bucket (missing apply_server_side_encryption_by_default block).", resourceBlock.FullName())).
 						WithRange(ruleBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -102,7 +102,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted S3 bucket (missing sse_algorithm attribute).", resourceBlock.FullName())).
 						WithRange(applyBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws018.go b/internal/app/tfsec/rules/aws018.go
index e6a3618e1..11a6b8156 100644
--- a/internal/app/tfsec/rules/aws018.go
+++ b/internal/app/tfsec/rules/aws018.go
@@ -73,14 +73,14 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_security_group", "aws_security_group_rule"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			if resourceBlock.MissingChild("description") {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should include a description for auditing purposes.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -92,7 +92,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' should include a non-empty description for auditing purposes.", resourceBlock.FullName())).
 						WithRange(descriptionAttr.Range()).
 						WithAttributeAnnotation(descriptionAttr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws019.go b/internal/app/tfsec/rules/aws019.go
index 5c2d6553d..f9f789024 100644
--- a/internal/app/tfsec/rules/aws019.go
+++ b/internal/app/tfsec/rules/aws019.go
@@ -55,7 +55,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_kms_key"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			keyUsageAttr := resourceBlock.GetAttribute("key_usage")
 
@@ -70,7 +70,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not have KMS Key auto-rotation enabled.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 				return
 			}
@@ -81,7 +81,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' does not have KMS Key auto-rotation enabled.", resourceBlock.FullName())).
 						WithRange(keyRotationAttr.Range()).
 						WithAttributeAnnotation(keyRotationAttr).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws020.go b/internal/app/tfsec/rules/aws020.go
index 122d1642e..9d55cde2f 100644
--- a/internal/app/tfsec/rules/aws020.go
+++ b/internal/app/tfsec/rules/aws020.go
@@ -61,7 +61,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_cloudfront_distribution"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, context *hclcontext.Context) {
 
 			defaultBehaviorBlock := resourceBlock.GetBlock("default_cache_behavior")
@@ -70,7 +70,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a CloudFront distribution that allows unencrypted communications (missing default_cache_behavior block).", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			} else {
 				protocolPolicyAttr := defaultBehaviorBlock.GetAttribute("viewer_protocol_policy")
@@ -79,7 +79,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' defines a CloudFront distribution that allows unencrypted communications (missing viewer_protocol_policy block).", resourceBlock.FullName())).
 							WithRange(resourceBlock.Range()).
-							WithSeverity(severity.Error),
+							WithSeverity(severity.High),
 					)
 				} else if protocolPolicyAttr.Type() == cty.String && protocolPolicyAttr.Value().AsString() == "allow-all" {
 					set.Add(
@@ -87,7 +87,7 @@ func init() {
 							WithDescription(fmt.Sprintf("Resource '%s' defines a CloudFront distribution that allows unencrypted communications.", resourceBlock.FullName())).
 							WithRange(protocolPolicyAttr.Range()).
 							WithAttributeAnnotation(protocolPolicyAttr).
-							WithSeverity(severity.Error),
+							WithSeverity(severity.High),
 					)
 				}
 			}
@@ -100,7 +100,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' defines a CloudFront distribution that allows unencrypted communications (missing viewer_protocol_policy block).", resourceBlock.FullName())).
 							WithRange(resourceBlock.Range()).
-							WithSeverity(severity.Error),
+							WithSeverity(severity.High),
 					)
 				} else if orderedProtocolPolicyAttr.Type() == cty.String && orderedProtocolPolicyAttr.Value().AsString() == "allow-all" {
 					set.Add(
@@ -108,7 +108,7 @@ func init() {
 							WithDescription(fmt.Sprintf("Resource '%s' defines a CloudFront distribution that allows unencrypted communications.", resourceBlock.FullName())).
 							WithRange(orderedProtocolPolicyAttr.Range()).
 							WithAttributeAnnotation(orderedProtocolPolicyAttr).
-							WithSeverity(severity.Error),
+							WithSeverity(severity.High),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws021.go b/internal/app/tfsec/rules/aws021.go
index 674b27db8..b1e818407 100644
--- a/internal/app/tfsec/rules/aws021.go
+++ b/internal/app/tfsec/rules/aws021.go
@@ -61,7 +61,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_cloudfront_distribution"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, context *hclcontext.Context) {
 
 			viewerCertificateBlock := resourceBlock.GetBlock("viewer_certificate")
@@ -70,7 +70,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines outdated SSL/TLS policies (missing viewer_certificate block)", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -80,14 +80,14 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines outdated SSL/TLS policies (missing minimum_protocol_version attribute)", resourceBlock.FullName())).
 						WithRange(viewerCertificateBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			} else if minVersion.Type() == cty.String && minVersion.Value().AsString() != "TLSv1.2_2021" {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines outdated SSL/TLS policies (not using TLSv1.2_2021)", resourceBlock.FullName())).
 						WithRange(minVersion.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws022.go b/internal/app/tfsec/rules/aws022.go
index 9267764fe..ed98e3360 100644
--- a/internal/app/tfsec/rules/aws022.go
+++ b/internal/app/tfsec/rules/aws022.go
@@ -63,7 +63,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_msk_cluster"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, context *hclcontext.Context) {
 
 			defaultBehaviorBlock := resourceBlock.GetBlock("encryption_info")
@@ -72,7 +72,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a MSK cluster that allows plaintext as well as TLS encrypted data in transit (missing encryption_info block).", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 				return
 			}
@@ -83,7 +83,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a MSK cluster that allows plaintext as well as TLS encrypted data in transit (missing encryption_in_transit block).", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 				return
 			}
@@ -94,7 +94,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a MSK cluster that allows plaintext as well as TLS encrypted data in transit (missing client_broker block).", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 			} else if clientBrokerAttr.Value().AsString() == "PLAINTEXT" {
 				set.Add(
@@ -102,7 +102,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' defines a MSK cluster that only allows plaintext data in transit.", resourceBlock.FullName())).
 						WithRange(clientBrokerAttr.Range()).
 						WithAttributeAnnotation(clientBrokerAttr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			} else if clientBrokerAttr.Value().AsString() == "TLS_PLAINTEXT" {
 				set.Add(
@@ -110,7 +110,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' defines a MSK cluster that allows plaintext as well as TLS encrypted data in transit.", resourceBlock.FullName())).
 						WithRange(clientBrokerAttr.Range()).
 						WithAttributeAnnotation(clientBrokerAttr).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws023.go b/internal/app/tfsec/rules/aws023.go
index 09a500152..96b11ea4a 100644
--- a/internal/app/tfsec/rules/aws023.go
+++ b/internal/app/tfsec/rules/aws023.go
@@ -65,7 +65,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_ecr_repository"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, context *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("image_scanning_configuration") {
@@ -73,7 +73,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a disabled ECR image scan.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -86,7 +86,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a disabled ECR image scan.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			} else if ecrScanStatusAttr.Type() == cty.Bool && ecrScanStatusAttr.Value().False() {
 				set.Add(
@@ -94,7 +94,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' defines a disabled ECR image scan.", resourceBlock.FullName())).
 						WithRange(ecrScanStatusAttr.Range()).
 						WithAttributeAnnotation(ecrScanStatusAttr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws024.go b/internal/app/tfsec/rules/aws024.go
index 558bc896e..313cff26a 100644
--- a/internal/app/tfsec/rules/aws024.go
+++ b/internal/app/tfsec/rules/aws024.go
@@ -57,7 +57,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_kinesis_stream"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, context *hclcontext.Context) {
 
 			encryptionTypeAttr := resourceBlock.GetAttribute("encryption_type")
@@ -66,7 +66,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted Kinesis Stream.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			} else if encryptionTypeAttr.Type() == cty.String && strings.ToUpper(encryptionTypeAttr.Value().AsString()) != "KMS" {
 				set.Add(
@@ -74,7 +74,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted Kinesis Stream.", resourceBlock.FullName())).
 						WithRange(encryptionTypeAttr.Range()).
 						WithAttributeAnnotation(encryptionTypeAttr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			} else {
 				keyIDAttr := resourceBlock.GetAttribute("kms_key_id")
@@ -83,7 +83,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' defines a Kinesis Stream encrypted with the default Kinesis key.", resourceBlock.FullName())).
 							WithRange(resourceBlock.Range()).
-							WithSeverity(severity.Warning),
+							WithSeverity(severity.Medium),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws025.go b/internal/app/tfsec/rules/aws025.go
index 7369e3cba..10036f33c 100644
--- a/internal/app/tfsec/rules/aws025.go
+++ b/internal/app/tfsec/rules/aws025.go
@@ -55,7 +55,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_api_gateway_domain_name"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			securityPolicyAttr := resourceBlock.GetAttribute("security_policy")
@@ -64,7 +64,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should include security_policy (defaults to outdated SSL/TLS policy).", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -75,7 +75,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' defines outdated SSL/TLS policies (not using TLS_1_2).", resourceBlock.FullName())).
 						WithRange(securityPolicyAttr.Range()).
 						WithAttributeAnnotation(securityPolicyAttr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws031.go b/internal/app/tfsec/rules/aws031.go
index b9045433a..d5dde6112 100644
--- a/internal/app/tfsec/rules/aws031.go
+++ b/internal/app/tfsec/rules/aws031.go
@@ -63,7 +63,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_elasticsearch_domain"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, context *hclcontext.Context) {
 
 			encryptionBlock := resourceBlock.GetBlock("encrypt_at_rest")
@@ -72,7 +72,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted Elasticsearch domain (missing encrypt_at_rest block).", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -83,7 +83,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted Elasticsearch domain (missing enabled attribute).", resourceBlock.FullName())).
 						WithRange(encryptionBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -97,7 +97,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted Elasticsearch domain (enabled attribute set to false).", resourceBlock.FullName())).
 						WithRange(encryptionBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws032.go b/internal/app/tfsec/rules/aws032.go
index 451ceefc7..a96aad9f7 100644
--- a/internal/app/tfsec/rules/aws032.go
+++ b/internal/app/tfsec/rules/aws032.go
@@ -63,7 +63,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_elasticsearch_domain"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, context *hclcontext.Context) {
 
 			encryptionBlock := resourceBlock.GetBlock("node_to_node_encryption")
@@ -72,7 +72,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an Elasticsearch domain with plaintext traffic (missing node_to_node_encryption block).", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -83,7 +83,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an Elasticsearch domain with plaintext traffic (missing enabled attribute).", resourceBlock.FullName())).
 						WithRange(encryptionBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -97,7 +97,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an Elasticsearch domain with plaintext traffic (enabled attribute set to false).", resourceBlock.FullName())).
 						WithRange(encryptionBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws033.go b/internal/app/tfsec/rules/aws033.go
index 182467a31..7da371eb2 100644
--- a/internal/app/tfsec/rules/aws033.go
+++ b/internal/app/tfsec/rules/aws033.go
@@ -65,7 +65,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_elasticsearch_domain"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, context *hclcontext.Context) {
 
 			endpointBlock := resourceBlock.GetBlock("domain_endpoint_options")
@@ -74,7 +74,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an Elasticsearch domain with plaintext traffic (missing domain_endpoint_options block).", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -85,7 +85,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an Elasticsearch domain with plaintext traffic (missing enforce_https attribute).", resourceBlock.FullName())).
 						WithRange(endpointBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -99,7 +99,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an Elasticsearch domain with plaintext traffic (enabled attribute set to false).", resourceBlock.FullName())).
 						WithRange(endpointBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws034.go b/internal/app/tfsec/rules/aws034.go
index fdf770610..3ab0be01b 100644
--- a/internal/app/tfsec/rules/aws034.go
+++ b/internal/app/tfsec/rules/aws034.go
@@ -65,7 +65,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_elasticsearch_domain"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, context *hclcontext.Context) {
 
 			endpointBlock := resourceBlock.GetBlock("domain_endpoint_options")
@@ -80,7 +80,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an Elasticsearch domain with an outdated TLS policy (defaults to Policy-Min-TLS-1-0-2019-07).", resourceBlock.FullName())).
 						WithRange(endpointBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -91,7 +91,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' defines an Elasticsearch domain with an outdated TLS policy (set to Policy-Min-TLS-1-0-2019-07).", resourceBlock.FullName())).
 						WithRange(tlsPolicyAttr.Range()).
 						WithAttributeAnnotation(tlsPolicyAttr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws035.go b/internal/app/tfsec/rules/aws035.go
index 8af16983b..d3016abab 100644
--- a/internal/app/tfsec/rules/aws035.go
+++ b/internal/app/tfsec/rules/aws035.go
@@ -59,7 +59,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_elasticache_replication_group"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, context *hclcontext.Context) {
 
 			encryptionAttr := resourceBlock.GetAttribute("at_rest_encryption_enabled")
@@ -68,7 +68,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted Elasticache Replication Group (missing at_rest_encryption_enabled attribute).", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			} else if !isBooleanOrStringTrue(encryptionAttr) {
 				set.Add(
@@ -76,7 +76,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted Elasticache Replication Group (at_rest_encryption_enabled set to false).", resourceBlock.FullName())).
 						WithRange(encryptionAttr.Range()).
 						WithAttributeAnnotation(encryptionAttr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws036.go b/internal/app/tfsec/rules/aws036.go
index 7ca31c3ff..9b654e625 100644
--- a/internal/app/tfsec/rules/aws036.go
+++ b/internal/app/tfsec/rules/aws036.go
@@ -59,7 +59,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_elasticache_replication_group"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, context *hclcontext.Context) {
 
 			encryptionAttr := resourceBlock.GetAttribute("transit_encryption_enabled")
@@ -68,7 +68,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted Elasticache Replication Group (missing transit_encryption_enabled attribute).", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			} else if !isBooleanOrStringTrue(encryptionAttr) {
 				set.Add(
@@ -76,7 +76,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' defines an unencrypted Elasticache Replication Group (transit_encryption_enabled set to false).", resourceBlock.FullName())).
 						WithRange(encryptionAttr.Range()).
 						WithAttributeAnnotation(encryptionAttr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 
 			}
diff --git a/internal/app/tfsec/rules/aws037.go b/internal/app/tfsec/rules/aws037.go
index e1aff43ee..d825f5407 100644
--- a/internal/app/tfsec/rules/aws037.go
+++ b/internal/app/tfsec/rules/aws037.go
@@ -64,14 +64,14 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_iam_account_password_policy"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			if attr := resourceBlock.GetAttribute("password_reuse_prevention"); attr == nil {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not have a password reuse prevention count set.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 			} else if attr.Value().Type() == cty.Number {
 				value, _ := attr.Value().AsBigFloat().Float64()
@@ -80,7 +80,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' has a password reuse count less than 5.", resourceBlock.FullName())).
 							WithRange(resourceBlock.Range()).
-							WithSeverity(severity.Warning),
+							WithSeverity(severity.Medium),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws038.go b/internal/app/tfsec/rules/aws038.go
index cf0340db2..1c1ea4bb4 100644
--- a/internal/app/tfsec/rules/aws038.go
+++ b/internal/app/tfsec/rules/aws038.go
@@ -63,14 +63,14 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_iam_account_password_policy"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			if attr := resourceBlock.GetAttribute("max_password_age"); attr == nil {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not have a max password age set.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 			} else if attr.Value().Type() == cty.Number {
 				value, _ := attr.Value().AsBigFloat().Float64()
@@ -80,7 +80,7 @@ func init() {
 							WithDescription(fmt.Sprintf("Resource '%s' has high password age.", resourceBlock.FullName())).
 							WithRange(attr.Range()).
 							WithAttributeAnnotation(attr).
-							WithSeverity(severity.Warning),
+							WithSeverity(severity.Medium),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws039.go b/internal/app/tfsec/rules/aws039.go
index 7a16bc8e5..d83fc5558 100644
--- a/internal/app/tfsec/rules/aws039.go
+++ b/internal/app/tfsec/rules/aws039.go
@@ -63,14 +63,14 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_iam_account_password_policy"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			if attr := resourceBlock.GetAttribute("minimum_password_length"); attr == nil {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not have a minimum password length set.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 			} else if attr.Value().Type() == cty.Number {
 				value, _ := attr.Value().AsBigFloat().Float64()
@@ -79,7 +79,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' has a minimum password length which is less than 14 characters.", resourceBlock.FullName())).
 							WithRange(resourceBlock.Range()).
-							WithSeverity(severity.Warning),
+							WithSeverity(severity.Medium),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws040.go b/internal/app/tfsec/rules/aws040.go
index 58e482ab8..00d5ce772 100644
--- a/internal/app/tfsec/rules/aws040.go
+++ b/internal/app/tfsec/rules/aws040.go
@@ -61,14 +61,14 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_iam_account_password_policy"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			if attr := resourceBlock.GetAttribute("require_symbols"); attr == nil {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not require a symbol in the password.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 			} else if attr.Value().Type() == cty.Bool {
 				if attr.Value().False() {
@@ -76,7 +76,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' explicitly specifies not requiring at least one symbol in the password.", resourceBlock.FullName())).
 							WithRange(resourceBlock.Range()).
-							WithSeverity(severity.Warning),
+							WithSeverity(severity.Medium),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws041.go b/internal/app/tfsec/rules/aws041.go
index 77c3e3304..4c435696d 100644
--- a/internal/app/tfsec/rules/aws041.go
+++ b/internal/app/tfsec/rules/aws041.go
@@ -61,14 +61,14 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_iam_account_password_policy"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			if attr := resourceBlock.GetAttribute("require_numbers"); attr == nil {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not require a number in the password.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 			} else if attr.Value().Type() == cty.Bool {
 				if attr.Value().False() {
@@ -76,7 +76,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' explicitly specifies not requiring at least one number in the password.", resourceBlock.FullName())).
 							WithRange(resourceBlock.Range()).
-							WithSeverity(severity.Warning),
+							WithSeverity(severity.Medium),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws042.go b/internal/app/tfsec/rules/aws042.go
index e3fefce86..6e3faff9f 100644
--- a/internal/app/tfsec/rules/aws042.go
+++ b/internal/app/tfsec/rules/aws042.go
@@ -61,14 +61,14 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_iam_account_password_policy"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			if attr := resourceBlock.GetAttribute("require_lowercase_characters"); attr == nil {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not require a lowercase character in the password.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 			} else if attr.Value().Type() == cty.Bool {
 				if attr.Value().False() {
@@ -76,7 +76,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' explicitly specifies not requiring at least lowercase character in the password.", resourceBlock.FullName())).
 							WithRange(resourceBlock.Range()).
-							WithSeverity(severity.Warning),
+							WithSeverity(severity.Medium),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws043.go b/internal/app/tfsec/rules/aws043.go
index c1526ccc0..51b6f11c7 100644
--- a/internal/app/tfsec/rules/aws043.go
+++ b/internal/app/tfsec/rules/aws043.go
@@ -61,14 +61,14 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_iam_account_password_policy"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			if attr := resourceBlock.GetAttribute("require_uppercase_characters"); attr == nil {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not require an uppercase character in the password.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 			} else if attr.Value().Type() == cty.Bool {
 				if attr.Value().False() {
@@ -76,7 +76,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' explicitly specifies not requiring at least one uppercase character in the password.", resourceBlock.FullName())).
 							WithRange(resourceBlock.Range()).
-							WithSeverity(severity.Warning),
+							WithSeverity(severity.Medium),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws044.go b/internal/app/tfsec/rules/aws044.go
index 540272d26..77e39a989 100644
--- a/internal/app/tfsec/rules/aws044.go
+++ b/internal/app/tfsec/rules/aws044.go
@@ -54,7 +54,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"provider"},
 		RequiredLabels:  []string{"aws"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if accessKeyAttribute := resourceBlock.GetAttribute("access_key"); accessKeyAttribute != nil && accessKeyAttribute.Type() == cty.String {
@@ -63,7 +63,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Provider '%s' has an access key specified.", resourceBlock.FullName())).
 						WithRange(accessKeyAttribute.Range()).
 						WithAttributeAnnotation(accessKeyAttribute).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			} else if secretKeyAttribute := resourceBlock.GetAttribute("secret_key"); secretKeyAttribute != nil && secretKeyAttribute.Type() == cty.String {
 				set.Add(
@@ -71,7 +71,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Provider '%s' has a secret key specified.", resourceBlock.FullName())).
 						WithRange(secretKeyAttribute.Range()).
 						WithAttributeAnnotation(secretKeyAttribute).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws045.go b/internal/app/tfsec/rules/aws045.go
index e5ac1c552..b40270e34 100644
--- a/internal/app/tfsec/rules/aws045.go
+++ b/internal/app/tfsec/rules/aws045.go
@@ -108,7 +108,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_cloudfront_distribution"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, context *hclcontext.Context) {
 
 			wafAclIdBlock := resourceBlock.GetAttribute("web_acl_id")
@@ -117,7 +117,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not have a WAF in front of it.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws046.go b/internal/app/tfsec/rules/aws046.go
index a0142bde7..e33acf39f 100644
--- a/internal/app/tfsec/rules/aws046.go
+++ b/internal/app/tfsec/rules/aws046.go
@@ -69,7 +69,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"data"},
 		RequiredLabels:  []string{"aws_iam_policy_document"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if statementBlocks := resourceBlock.GetBlocks("statement"); statementBlocks != nil {
@@ -87,7 +87,7 @@ func init() {
 									result.New(resourceBlock).
 										WithDescription(fmt.Sprintf("Resource '%s' has a wildcard action specified.", resourceBlock.FullName())).
 										WithRange(statementBlock.Range()).
-										WithSeverity(severity.Error),
+										WithSeverity(severity.High),
 								)
 							}
 						}
diff --git a/internal/app/tfsec/rules/aws047.go b/internal/app/tfsec/rules/aws047.go
index c8bd3097d..7f2a2d380 100644
--- a/internal/app/tfsec/rules/aws047.go
+++ b/internal/app/tfsec/rules/aws047.go
@@ -83,7 +83,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_sqs_queue_policy"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("policy") {
@@ -109,7 +109,7 @@ func init() {
 							result.New(resourceBlock).
 								WithDescription(fmt.Sprintf("SQS policy '%s' has a wildcard action specified.", resourceBlock.FullName())).
 								WithRange(resourceBlock.Range()).
-								WithSeverity(severity.Error),
+								WithSeverity(severity.High),
 						)
 					}
 				}
diff --git a/internal/app/tfsec/rules/aws048.go b/internal/app/tfsec/rules/aws048.go
index 0dc2c40a2..1890fa4b9 100644
--- a/internal/app/tfsec/rules/aws048.go
+++ b/internal/app/tfsec/rules/aws048.go
@@ -57,7 +57,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_efs_file_system"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			efsEnabledAttr := resourceBlock.GetAttribute("encrypted")
@@ -67,7 +67,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not specify if encryption should be used.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			} else if efsEnabledAttr.Type() == cty.Bool && efsEnabledAttr.Value().False() {
 				set.Add(
@@ -75,7 +75,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' actively does not have encryption applied.", resourceBlock.FullName())).
 						WithRange(efsEnabledAttr.Range()).
 						WithAttributeAnnotation(efsEnabledAttr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws049.go b/internal/app/tfsec/rules/aws049.go
index 38cde90a0..527b8cf82 100644
--- a/internal/app/tfsec/rules/aws049.go
+++ b/internal/app/tfsec/rules/aws049.go
@@ -63,7 +63,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_network_acl_rule"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			egressAttr := resourceBlock.GetAttribute("egress")
@@ -88,7 +88,7 @@ func init() {
 							result.New(resourceBlock).
 								WithDescription(fmt.Sprintf("Resource '%s' defines a Network ACL rule that allows specific ingress ports from anywhere.", resourceBlock.FullName())).
 								WithRange(cidrBlockAttr.Range()).
-								WithSeverity(severity.Warning),
+								WithSeverity(severity.Medium),
 						)
 					}
 				}
@@ -106,7 +106,7 @@ func init() {
 								WithDescription(fmt.Sprintf("Resource '%s' defines a Network ACL rule that allows specific ingress ports from anywhere.", resourceBlock.FullName())).
 								WithRange(ipv6CidrBlockAttr.Range()).
 								WithAttributeAnnotation(ipv6CidrBlockAttr).
-								WithSeverity(severity.Warning),
+								WithSeverity(severity.Medium),
 						)
 					}
 				}
diff --git a/internal/app/tfsec/rules/aws050.go b/internal/app/tfsec/rules/aws050.go
index 504677add..a67c9a991 100644
--- a/internal/app/tfsec/rules/aws050.go
+++ b/internal/app/tfsec/rules/aws050.go
@@ -62,7 +62,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_network_acl_rule"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			egressAttr := resourceBlock.GetAttribute("egress")
@@ -89,7 +89,7 @@ func init() {
 								WithDescription(fmt.Sprintf("Resource '%s' defines a fully open ingress Network ACL rule with ALL ports open.", resourceBlock.FullName())).
 								WithRange(cidrBlockAttr.Range()).
 								WithAttributeAnnotation(cidrBlockAttr).
-								WithSeverity(severity.Error),
+								WithSeverity(severity.High),
 						)
 					}
 				}
@@ -103,7 +103,7 @@ func init() {
 								WithDescription(fmt.Sprintf("Resource '%s' defines a fully open ingress Network ACL rule with ALL ports open.", resourceBlock.FullName())).
 								WithRange(ipv6CidrBlockAttr.Range()).
 								WithAttributeAnnotation(ipv6CidrBlockAttr).
-								WithSeverity(severity.Error),
+								WithSeverity(severity.High),
 						)
 					}
 				}
diff --git a/internal/app/tfsec/rules/aws051.go b/internal/app/tfsec/rules/aws051.go
index 9f4a2d7b8..bcbd08ff2 100644
--- a/internal/app/tfsec/rules/aws051.go
+++ b/internal/app/tfsec/rules/aws051.go
@@ -56,7 +56,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_rds_cluster"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			kmsKeyIdAttr := resourceBlock.GetAttribute("kms_key_id")
@@ -68,7 +68,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a disabled RDS Cluster encryption.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			} else if kmsKeyIdAttr != nil && kmsKeyIdAttr.Equals("") {
 				set.Add(
@@ -76,7 +76,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' defines a disabled RDS Cluster encryption.", resourceBlock.FullName())).
 						WithRange(kmsKeyIdAttr.Range()).
 						WithAttributeAnnotation(kmsKeyIdAttr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			} else if storageEncryptedattr == nil || storageEncryptedattr.IsFalse() {
 				set.Add(
@@ -84,7 +84,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' defines a enabled RDS Cluster encryption but not the required encrypted_storage.", resourceBlock.FullName())).
 						WithRange(kmsKeyIdAttr.Range()).
 						WithAttributeAnnotation(kmsKeyIdAttr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws052.go b/internal/app/tfsec/rules/aws052.go
index 5fd98e802..c7fb0f1c8 100644
--- a/internal/app/tfsec/rules/aws052.go
+++ b/internal/app/tfsec/rules/aws052.go
@@ -55,7 +55,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_db_instance"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("storage_encrypted") {
@@ -63,7 +63,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has no storage encryption defined.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -75,7 +75,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' has storage encrypted set to false", resourceBlock.FullName())).
 						WithRange(storageEncryptedAttr.Range()).
 						WithAttributeAnnotation(storageEncryptedAttr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws053.go b/internal/app/tfsec/rules/aws053.go
index 5c6b25c2c..22adc7c74 100644
--- a/internal/app/tfsec/rules/aws053.go
+++ b/internal/app/tfsec/rules/aws053.go
@@ -60,7 +60,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_rds_cluster_instance", "aws_db_instance"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.HasChild("performance_insights_enabled") && resourceBlock.GetAttribute("performance_insights_enabled").IsTrue() {
@@ -69,7 +69,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' defines Performance Insights without encryption key specified.", resourceBlock.FullName())).
 							WithRange(resourceBlock.Range()).
-							WithSeverity(severity.Error),
+							WithSeverity(severity.High),
 					)
 					return
 				}
@@ -80,7 +80,7 @@ func init() {
 							WithDescription(fmt.Sprintf("Resource '%s' defines Performance Insights without encryption key specified.", resourceBlock.FullName())).
 							WithRange(keyAttr.Range()).
 							WithAttributeAnnotation(keyAttr).
-							WithSeverity(severity.Error),
+							WithSeverity(severity.High),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws057.go b/internal/app/tfsec/rules/aws057.go
index 0d716ba92..a28c7de24 100644
--- a/internal/app/tfsec/rules/aws057.go
+++ b/internal/app/tfsec/rules/aws057.go
@@ -90,7 +90,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_elasticsearch_domain"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("log_publishing_options") {
@@ -98,7 +98,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not configure logging at rest on the domain.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -112,7 +112,7 @@ func init() {
 							WithDescription(fmt.Sprintf("Resource '%s' explicitly disables logging on the domain.", resourceBlock.FullName())).
 							WithRange(enabledAttr.Range()).
 							WithAttributeAnnotation(enabledAttr).
-							WithSeverity(severity.Error),
+							WithSeverity(severity.High),
 					)
 					return
 				}
diff --git a/internal/app/tfsec/rules/aws058.go b/internal/app/tfsec/rules/aws058.go
index 474bd003d..bf0e1a732 100644
--- a/internal/app/tfsec/rules/aws058.go
+++ b/internal/app/tfsec/rules/aws058.go
@@ -62,7 +62,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_lambda_permission"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.HasChild("principal") {
@@ -72,7 +72,7 @@ func init() {
 							result.New(resourceBlock).
 								WithDescription(fmt.Sprintf("Resource '%s' missing source ARN but has *.amazonaws.com Principal.", resourceBlock.FullName())).
 								WithRange(resourceBlock.Range()).
-								WithSeverity(severity.Error),
+								WithSeverity(severity.High),
 						)
 					}
 				}
diff --git a/internal/app/tfsec/rules/aws059.go b/internal/app/tfsec/rules/aws059.go
index 7dae1f846..3f502549b 100644
--- a/internal/app/tfsec/rules/aws059.go
+++ b/internal/app/tfsec/rules/aws059.go
@@ -94,7 +94,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_athena_database", "aws_athena_workgroup"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			blockName := resourceBlock.FullName()
@@ -115,7 +115,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' missing encryption configuration block.", blockName)).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws060.go b/internal/app/tfsec/rules/aws060.go
index 45db52002..6aa56d06f 100644
--- a/internal/app/tfsec/rules/aws060.go
+++ b/internal/app/tfsec/rules/aws060.go
@@ -86,7 +86,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_athena_workgroup"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("configuration") {
@@ -94,7 +94,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' is missing the configuration block.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -106,7 +106,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has enforce_workgroup_configuration set to false.", resourceBlock.FullName())).
 						WithRange(configBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws061.go b/internal/app/tfsec/rules/aws061.go
index 98e5a671d..c1d7a4095 100644
--- a/internal/app/tfsec/rules/aws061.go
+++ b/internal/app/tfsec/rules/aws061.go
@@ -77,7 +77,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_apigatewayv2_stage", "aws_api_gateway_stage"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("access_log_settings") {
@@ -85,7 +85,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' is missing access log settings block.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws062.go b/internal/app/tfsec/rules/aws062.go
index 75bbb3581..a0cbacefd 100644
--- a/internal/app/tfsec/rules/aws062.go
+++ b/internal/app/tfsec/rules/aws062.go
@@ -72,7 +72,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_instance"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("user_data") {
@@ -87,7 +87,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' has userdata with access key id defined.", resourceBlock.FullName())).
 						WithRange(userDataAttr.Range()).
 						WithAttributeAnnotation(userDataAttr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
@@ -98,7 +98,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' has userdata with access secret key defined.", resourceBlock.FullName())).
 						WithRange(userDataAttr.Range()).
 						WithAttributeAnnotation(userDataAttr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws063.go b/internal/app/tfsec/rules/aws063.go
index 58eeb3f43..5bfe97ad1 100644
--- a/internal/app/tfsec/rules/aws063.go
+++ b/internal/app/tfsec/rules/aws063.go
@@ -71,14 +71,14 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_cloudtrail"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			if resourceBlock.MissingChild("is_multi_region_trail") {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not set multi region trail config.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 				return
 			}
@@ -90,7 +90,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' does not enable multi region trail.", resourceBlock.FullName())).
 						WithRange(multiRegionAttr.Range()).
 						WithAttributeAnnotation(multiRegionAttr).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws064.go b/internal/app/tfsec/rules/aws064.go
index 78d2aba8e..0df0d9940 100644
--- a/internal/app/tfsec/rules/aws064.go
+++ b/internal/app/tfsec/rules/aws064.go
@@ -74,14 +74,14 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_cloudtrail"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			if resourceBlock.MissingChild("enable_log_file_validation") {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not enable log file validation.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 				return
 			}
@@ -93,7 +93,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' does not enable log file validation.", resourceBlock.FullName())).
 						WithRange(logFileValidationAttr.Range()).
 						WithAttributeAnnotation(logFileValidationAttr).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws065.go b/internal/app/tfsec/rules/aws065.go
index 3f448bd39..68d6dbff1 100644
--- a/internal/app/tfsec/rules/aws065.go
+++ b/internal/app/tfsec/rules/aws065.go
@@ -75,7 +75,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_cloudtrail"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("kms_key_id") {
@@ -83,7 +83,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not have a kms_key_id set.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -95,7 +95,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' has a kms_key_id but it is not set.", resourceBlock.FullName())).
 						WithRange(kmsKeyIdAttr.Range()).
 						WithAttributeAnnotation(kmsKeyIdAttr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws066.go b/internal/app/tfsec/rules/aws066.go
index fdb312753..42c8bca93 100644
--- a/internal/app/tfsec/rules/aws066.go
+++ b/internal/app/tfsec/rules/aws066.go
@@ -69,7 +69,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_eks_cluster"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("encryption_config") {
@@ -77,7 +77,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has no encryptionConfigBlock block", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -88,7 +88,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has encryptionConfigBlock block with no resourcesAttr attribute specified", resourceBlock.FullName())).
 						WithRange(encryptionConfigBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -100,7 +100,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' does not include secrets in encrypted resources", resourceBlock.FullName())).
 						WithRange(resourcesAttr.Range()).
 						WithAttributeAnnotation(resourcesAttr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
@@ -109,7 +109,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has encryptionConfigBlock block with no provider block specified", resourceBlock.FullName())).
 						WithRange(encryptionConfigBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -120,7 +120,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has encryptionConfigBlock block with provider block specified missing key arn", resourceBlock.FullName())).
 						WithRange(encryptionConfigBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -132,7 +132,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' has encryptionConfigBlock block with provider block specified but key_arn is empty", resourceBlock.FullName())).
 						WithRange(keyArnAttr.Range()).
 						WithAttributeAnnotation(keyArnAttr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws067.go b/internal/app/tfsec/rules/aws067.go
index abe004e2f..626a1340e 100644
--- a/internal/app/tfsec/rules/aws067.go
+++ b/internal/app/tfsec/rules/aws067.go
@@ -77,7 +77,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_eks_cluster"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			controlPlaneLogging := []string{"api", "audit", "authenticator", "controllerManager", "scheduler"}
@@ -87,7 +87,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' missing the enabled_cluster_log_types attribute to enable control plane logging", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -100,7 +100,7 @@ func init() {
 							WithDescription(fmt.Sprintf("Resource '%s' is missing the control plane log type '%s'", resourceBlock.FullName(), logType)).
 							WithRange(configuredLoggingAttr.Range()).
 							WithAttributeAnnotation(configuredLoggingAttr).
-							WithSeverity(severity.Error),
+							WithSeverity(severity.High),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws068.go b/internal/app/tfsec/rules/aws068.go
index b06adb48c..9ea79a9ea 100644
--- a/internal/app/tfsec/rules/aws068.go
+++ b/internal/app/tfsec/rules/aws068.go
@@ -66,7 +66,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_eks_cluster"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("vpc_config") {
@@ -74,7 +74,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has no vpc_config block specified so default public access cidrs is set", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -85,7 +85,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' is using default public access cidrs in the vpc config", resourceBlock.FullName())).
 						WithRange(vpcConfig.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -97,7 +97,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' has public access cidr explicitly set to wide open", resourceBlock.FullName())).
 						WithRange(publicAccessCidrsAttr.Range()).
 						WithAttributeAnnotation(publicAccessCidrsAttr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws069.go b/internal/app/tfsec/rules/aws069.go
index ba5a0de0a..b0d5b6166 100644
--- a/internal/app/tfsec/rules/aws069.go
+++ b/internal/app/tfsec/rules/aws069.go
@@ -66,7 +66,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_eks_cluster"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("vpc_config") {
@@ -74,7 +74,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has no vpc_config block specified so default public access is enabled", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -85,7 +85,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' is using default public access in the vpc config", resourceBlock.FullName())).
 						WithRange(vpcConfig.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -97,7 +97,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' has public access is explicitly set to enabled", resourceBlock.FullName())).
 						WithRange(publicAccessEnabledAttr.Range()).
 						WithAttributeAnnotation(publicAccessEnabledAttr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws070.go b/internal/app/tfsec/rules/aws070.go
index 77504d4a5..be6f79d62 100644
--- a/internal/app/tfsec/rules/aws070.go
+++ b/internal/app/tfsec/rules/aws070.go
@@ -64,7 +64,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_elasticsearch_domain"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			logPublishingOptions := resourceBlock.GetBlocks("log_publishing_options")
 			if len(logPublishingOptions) > 0 {
@@ -83,7 +83,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' is missing 'AUDIT_LOGS` in one of the `log_publishing_options`-`log_type` attributes so audit log is not enabled", resourceBlock.FullName())).
 							WithRange(resourceBlock.Range()).
-							WithSeverity(severity.Error),
+							WithSeverity(severity.High),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws071.go b/internal/app/tfsec/rules/aws071.go
index 4b9464efc..2397905f1 100644
--- a/internal/app/tfsec/rules/aws071.go
+++ b/internal/app/tfsec/rules/aws071.go
@@ -59,7 +59,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_cloudfront_distribution"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("logging_config") {
@@ -67,7 +67,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not have Access Logging configured", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws072.go b/internal/app/tfsec/rules/aws072.go
index ece480980..4a68b66ef 100644
--- a/internal/app/tfsec/rules/aws072.go
+++ b/internal/app/tfsec/rules/aws072.go
@@ -88,7 +88,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_cloudfront_distribution"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if defaultCacheBlock := resourceBlock.GetBlock("default_cache_behavior"); defaultCacheBlock != nil {
@@ -97,7 +97,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' does not use HTTPS in Viewer Protocol Policy", resourceBlock.FullName())).
 							WithRange(defaultCacheBlock.Range()).
-							WithSeverity(severity.Error),
+							WithSeverity(severity.High),
 					)
 				}
 			}
@@ -109,7 +109,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' does not use HTTPS in Viewer Protocol Policy", resourceBlock.FullName())).
 							WithRange(orderedCacheBlock.Range()).
-							WithSeverity(severity.Error),
+							WithSeverity(severity.High),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws073.go b/internal/app/tfsec/rules/aws073.go
index ce77e7e84..c3c0b090e 100644
--- a/internal/app/tfsec/rules/aws073.go
+++ b/internal/app/tfsec/rules/aws073.go
@@ -61,7 +61,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_s3_bucket_public_access_block"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("ignore_public_acls") {
@@ -69,7 +69,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not specify ignore_public_acls, defaults to false", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -81,7 +81,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' sets ignore_public_acls explicitly to false", resourceBlock.FullName())).
 						WithRange(attr.Range()).
 						WithAttributeAnnotation(attr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws074.go b/internal/app/tfsec/rules/aws074.go
index ee3704053..5c5cb046a 100644
--- a/internal/app/tfsec/rules/aws074.go
+++ b/internal/app/tfsec/rules/aws074.go
@@ -61,14 +61,14 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_s3_bucket_public_access_block"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			if resourceBlock.MissingChild("block_public_acls") {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not specify block_public_acls, defaults to false", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -80,7 +80,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' sets block_public_acls explicitly to false", resourceBlock.FullName())).
 						WithRange(attr.Range()).
 						WithAttributeAnnotation(attr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws075.go b/internal/app/tfsec/rules/aws075.go
index dde1c81f3..0d230b74e 100644
--- a/internal/app/tfsec/rules/aws075.go
+++ b/internal/app/tfsec/rules/aws075.go
@@ -61,14 +61,14 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_s3_bucket_public_access_block"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			if resourceBlock.MissingChild("restrict_public_buckets") {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not specify restrict_public_buckets, defaults to false", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -80,7 +80,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' sets restrict_public_buckets explicitly to false", resourceBlock.FullName())).
 						WithRange(attr.Range()).
 						WithAttributeAnnotation(attr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws076.go b/internal/app/tfsec/rules/aws076.go
index 7bcc71980..cf6f083b2 100644
--- a/internal/app/tfsec/rules/aws076.go
+++ b/internal/app/tfsec/rules/aws076.go
@@ -61,14 +61,14 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_s3_bucket_public_access_block"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			if resourceBlock.MissingChild("block_public_policy") {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not specify block_public_policy, defaults to false", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -80,7 +80,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' sets block_public_policy explicitly to false", resourceBlock.FullName())).
 						WithRange(attr.Range()).
 						WithAttributeAnnotation(attr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws077.go b/internal/app/tfsec/rules/aws077.go
index 784ee010a..52e7edec4 100644
--- a/internal/app/tfsec/rules/aws077.go
+++ b/internal/app/tfsec/rules/aws077.go
@@ -58,7 +58,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_s3_bucket"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("versioning") {
@@ -66,7 +66,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not have versioning enabled", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -77,7 +77,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has versioning block but is disabled", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws078.go b/internal/app/tfsec/rules/aws078.go
index 098ddba14..4ac99b776 100644
--- a/internal/app/tfsec/rules/aws078.go
+++ b/internal/app/tfsec/rules/aws078.go
@@ -65,7 +65,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_ecr_repository"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			imageTagMutabilityAttr := resourceBlock.GetAttribute("image_tag_mutability")
@@ -74,7 +74,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' is missing `image_tag_mutability` attribute - it is required to make ecr image tag immutable.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -85,7 +85,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' has `image_tag_mutability` attribute  not set to `IMMUTABLE`", resourceBlock.FullName())).
 						WithRange(imageTagMutabilityAttr.Range()).
 						WithAttributeAnnotation(imageTagMutabilityAttr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws079.go b/internal/app/tfsec/rules/aws079.go
index a32fad7fc..9758bf2c0 100644
--- a/internal/app/tfsec/rules/aws079.go
+++ b/internal/app/tfsec/rules/aws079.go
@@ -60,7 +60,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_instance"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			metaDataOptions := resourceBlock.GetBlock("metadata_options")
@@ -69,7 +69,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' is missing `metadata_options` block - it is required with `http_tokens` set to `required` to make Instance Metadata Service more secure.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -89,7 +89,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' `metadata_options` `http_tokens` attribute - should be set to `required` to make Instance Metadata Service more secure.", resourceBlock.FullName())).
 							WithRange(httpTokensAttr.Range()).
-							WithSeverity(severity.Error),
+							WithSeverity(severity.High),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws080.go b/internal/app/tfsec/rules/aws080.go
index 507a70410..79abaefb3 100644
--- a/internal/app/tfsec/rules/aws080.go
+++ b/internal/app/tfsec/rules/aws080.go
@@ -104,7 +104,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_codebuild_project"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			blocks := resourceBlock.GetBlocks("secondary_artifacts")
@@ -122,7 +122,7 @@ func init() {
 								WithDescription(fmt.Sprintf("CodeBuild project '%s' is configured to disable artifact encryption while no artifacts are produced", resourceBlock.FullName())).
 								WithRange(artifactBlock.Range()).
 								WithAttributeAnnotation(artifactTypeAttr).
-								WithSeverity(severity.Warning),
+								WithSeverity(severity.Medium),
 						)
 					} else {
 						set.Add(
@@ -130,7 +130,7 @@ func init() {
 								WithDescription(fmt.Sprintf("CodeBuild project '%s' does not encrypt produced artifacts", resourceBlock.FullName())).
 								WithRange(artifactBlock.Range()).
 								WithAttributeAnnotation(encryptionDisabledAttr).
-								WithSeverity(severity.Error),
+								WithSeverity(severity.High),
 						)
 					}
 				}
diff --git a/internal/app/tfsec/rules/aws081.go b/internal/app/tfsec/rules/aws081.go
index c967c85b1..88b68d77b 100644
--- a/internal/app/tfsec/rules/aws081.go
+++ b/internal/app/tfsec/rules/aws081.go
@@ -74,14 +74,14 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_dax_cluster"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("server_side_encryption") {
 				res := result.New(resourceBlock).
 					WithDescription(fmt.Sprintf("DAX cluster '%s' does not have server side encryption configured. By default it is disabled.", resourceBlock.FullName())).
 					WithRange(resourceBlock.Range()).
-					WithSeverity(severity.Error)
+					WithSeverity(severity.High)
 				set.Add(res)
 				return
 			}
@@ -91,7 +91,7 @@ func init() {
 				res := result.New(resourceBlock).
 					WithDescription(fmt.Sprintf("DAX cluster '%s' server side encryption block is empty. By default SSE is disabled.", resourceBlock.FullName())).
 					WithRange(sseBlock.Range()).
-					WithSeverity(severity.Error)
+					WithSeverity(severity.High)
 				set.Add(res)
 				return
 			}
@@ -101,7 +101,7 @@ func init() {
 					WithDescription(fmt.Sprintf("DAX cluster '%s' has disabled server side encryption", resourceBlock.FullName())).
 					WithRange(sseEnabledAttr.Range()).
 					WithAttributeAnnotation(sseEnabledAttr).
-					WithSeverity(severity.Error)
+					WithSeverity(severity.High)
 				set.Add(res)
 			}
 
diff --git a/internal/app/tfsec/rules/aws082.go b/internal/app/tfsec/rules/aws082.go
index efffaaed0..9599f037f 100644
--- a/internal/app/tfsec/rules/aws082.go
+++ b/internal/app/tfsec/rules/aws082.go
@@ -53,13 +53,13 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_default_vpc"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			set.Add(
 				result.New(resourceBlock).
 					WithDescription(fmt.Sprintf("Resource '%s' should not exist", resourceBlock.FullName())).
 					WithRange(resourceBlock.Range()).
-					WithSeverity(severity.Error),
+					WithSeverity(severity.High),
 			)
 		},
 	})
diff --git a/internal/app/tfsec/rules/aws083.go b/internal/app/tfsec/rules/aws083.go
index 5a9058786..97b026818 100644
--- a/internal/app/tfsec/rules/aws083.go
+++ b/internal/app/tfsec/rules/aws083.go
@@ -75,7 +75,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_alb", "aws_lb"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.GetAttribute("load_balancer_type") == nil {
@@ -88,7 +88,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' does not drop invalid header fields", resourceBlock.FullName())).
 							WithRange(resourceBlock.Range()).
-							WithSeverity(severity.Error),
+							WithSeverity(severity.High),
 					)
 					return
 				}
@@ -100,7 +100,7 @@ func init() {
 							WithDescription(fmt.Sprintf("Resource '%s' sets the drop_invalid_header_fields to false", resourceBlock.FullName())).
 							WithRange(attr.Range()).
 							WithAttributeAnnotation(attr).
-							WithSeverity(severity.Error),
+							WithSeverity(severity.High),
 					)
 				}
 
diff --git a/internal/app/tfsec/rules/aws084.go b/internal/app/tfsec/rules/aws084.go
index c1dfbc3ff..08d088c21 100644
--- a/internal/app/tfsec/rules/aws084.go
+++ b/internal/app/tfsec/rules/aws084.go
@@ -75,7 +75,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_workspaces_workspace"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("root_volume_encryption_enabled") {
@@ -83,7 +83,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should have root volume encryption enables", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			} else {
 				attr := resourceBlock.GetAttribute("root_volume_encryption_enabled")
@@ -92,7 +92,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' has the root volume encyption set to false", resourceBlock.FullName())).
 						WithRange(attr.Range()).
 						WithAttributeAnnotation(attr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 					)
 				}
 			}
@@ -101,7 +101,7 @@ func init() {
 				set.Add(result.New(resourceBlock).
 					WithDescription(fmt.Sprintf("Resource '%s' should have user volume encryption enables", resourceBlock.FullName())).
 					WithRange(resourceBlock.Range()).
-					WithSeverity(severity.Error),
+					WithSeverity(severity.High),
 				)
 				return
 			}
@@ -113,7 +113,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' has the user volume encyption set to false", resourceBlock.FullName())).
 						WithRange(attr.Range()).
 						WithAttributeAnnotation(attr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws085.go b/internal/app/tfsec/rules/aws085.go
index 2dda4c90e..80947b529 100644
--- a/internal/app/tfsec/rules/aws085.go
+++ b/internal/app/tfsec/rules/aws085.go
@@ -65,7 +65,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_config_configuration_aggregator"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			aggBlock := resourceBlock.GetFirstMatchingBlock("account_aggregation_source", "organization_aggregation_source")
@@ -74,7 +74,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should have account aggregation sources set", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -84,7 +84,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should have account aggregation sources to all regions", resourceBlock.FullName())).
 						WithRange(aggBlock.Range()).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 				return
 			}
@@ -96,7 +96,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' has all_regions set to false", resourceBlock.FullName())).
 						WithRange(allRegionsAttr.Range()).
 						WithAttributeAnnotation(allRegionsAttr).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws086.go b/internal/app/tfsec/rules/aws086.go
index 8b75c03b4..55c3d0497 100644
--- a/internal/app/tfsec/rules/aws086.go
+++ b/internal/app/tfsec/rules/aws086.go
@@ -77,7 +77,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_dynamodb_table"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("point_in_time_recovery") {
@@ -85,7 +85,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' doesn't have point in time recovery", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 				return
 			}
@@ -96,7 +96,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' doesn't have point in time recovery enabled", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 				return
 			}
@@ -107,7 +107,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' doesn't have point in time recovery enabled", resourceBlock.FullName())).
 						WithRange(enabledAttr.Range()).
 						WithAttributeAnnotation(enabledAttr).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws087.go b/internal/app/tfsec/rules/aws087.go
index 2ff6f4b54..dbc0e5d36 100644
--- a/internal/app/tfsec/rules/aws087.go
+++ b/internal/app/tfsec/rules/aws087.go
@@ -67,14 +67,14 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_redshift_cluster"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			if resourceBlock.MissingChild("cluster_subnet_group_name") {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' is being deployed outside of a VPC", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws088.go b/internal/app/tfsec/rules/aws088.go
index 5c1ec3c52..b0688109d 100644
--- a/internal/app/tfsec/rules/aws088.go
+++ b/internal/app/tfsec/rules/aws088.go
@@ -67,7 +67,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_elasticache_cluster"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			engineAttr := resourceBlock.GetAttribute("engine")
@@ -80,7 +80,7 @@ func init() {
 							result.New(resourceBlock).
 								WithDescription(fmt.Sprintf("Resource '%s' should have snapshot retention specified", resourceBlock.FullName())).
 								WithRange(resourceBlock.Range()).
-								WithSeverity(severity.Warning),
+								WithSeverity(severity.Medium),
 						)
 						return
 					}
@@ -91,7 +91,7 @@ func init() {
 								WithDescription(fmt.Sprintf("Resource '%s' has snapshot retention set to 0", resourceBlock.FullName())).
 								WithRange(snapshotRetentionAttr.Range()).
 								WithAttributeAnnotation(snapshotRetentionAttr).
-								WithSeverity(severity.Warning),
+								WithSeverity(severity.Medium),
 						)
 					}
 				}
diff --git a/internal/app/tfsec/rules/aws089.go b/internal/app/tfsec/rules/aws089.go
index 09e5bba08..a6eacbb4f 100644
--- a/internal/app/tfsec/rules/aws089.go
+++ b/internal/app/tfsec/rules/aws089.go
@@ -56,14 +56,14 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_cloudwatch_log_group"},
-		DefaultSeverity: severity.Info,
+		DefaultSeverity: severity.Low,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			if resourceBlock.MissingChild("kms_key_id") {
 				set.Add(
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' is only using default encryption", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Info),
+						WithSeverity(severity.Low),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws090.go b/internal/app/tfsec/rules/aws090.go
index 0b4b45eda..88ee9d113 100644
--- a/internal/app/tfsec/rules/aws090.go
+++ b/internal/app/tfsec/rules/aws090.go
@@ -58,7 +58,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_ecs_cluster"},
-		DefaultSeverity: severity.Info,
+		DefaultSeverity: severity.Low,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			settingsBlock := resourceBlock.GetBlocks("setting")
@@ -71,7 +71,7 @@ func init() {
 									WithDescription(fmt.Sprintf("Resource '%s' has containerInsights set to disabled", resourceBlock.FullName())).
 									WithRange(setting.Range()).
 									WithAttributeAnnotation(valueAttr).
-									WithSeverity(severity.Info),
+									WithSeverity(severity.Low),
 							)
 						}
 						return
@@ -82,7 +82,7 @@ func init() {
 				result.New(resourceBlock).
 					WithDescription(fmt.Sprintf("Resoure '%s' does not have containerInsights enabled", resourceBlock.FullName())).
 					WithRange(resourceBlock.Range()).
-					WithSeverity(severity.Info),
+					WithSeverity(severity.Low),
 			)
 		},
 	})
diff --git a/internal/app/tfsec/rules/aws091.go b/internal/app/tfsec/rules/aws091.go
index 1b0a9ee8b..0560cac59 100644
--- a/internal/app/tfsec/rules/aws091.go
+++ b/internal/app/tfsec/rules/aws091.go
@@ -94,7 +94,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_rds_cluster", "aws_db_instance"},
-		DefaultSeverity: severity.Info,
+		DefaultSeverity: severity.Low,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			if resourceBlock.HasChild("replicate_source_db") {
 				return
@@ -105,7 +105,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not have backup retention explicitly set", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Info),
+						WithSeverity(severity.Low),
 				)
 				return
 			}
@@ -117,7 +117,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' has backup retention period set to a low value", resourceBlock.FullName())).
 						WithRange(retentionAttr.Range()).
 						WithAttributeAnnotation(retentionAttr).
-						WithSeverity(severity.Info),
+						WithSeverity(severity.Low),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws092.go b/internal/app/tfsec/rules/aws092.go
index 046c02f62..80475f646 100644
--- a/internal/app/tfsec/rules/aws092.go
+++ b/internal/app/tfsec/rules/aws092.go
@@ -96,7 +96,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_dynamodb_table"},
-		DefaultSeverity: severity.Info,
+		DefaultSeverity: severity.Low,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("server_side_encryption") {
@@ -104,7 +104,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' is not using KMS CMK for encryption", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Info),
+						WithSeverity(severity.Low),
 				)
 				return
 			}
@@ -117,7 +117,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' has server side encryption configured but disabled", resourceBlock.FullName())).
 						WithRange(enabledAttr.Range()).
 						WithAttributeAnnotation(enabledAttr).
-						WithSeverity(severity.Info),
+						WithSeverity(severity.Low),
 				)
 			}
 
@@ -129,7 +129,7 @@ func init() {
 							WithDescription(fmt.Sprintf("Resource '%s' has KMS encryption configured but is using the default aws key", resourceBlock.FullName())).
 							WithRange(keyIdAttr.Range()).
 							WithAttributeAnnotation(keyIdAttr).
-							WithSeverity(severity.Info),
+							WithSeverity(severity.Low),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws093.go b/internal/app/tfsec/rules/aws093.go
index c0a8ee2f1..616e8668b 100644
--- a/internal/app/tfsec/rules/aws093.go
+++ b/internal/app/tfsec/rules/aws093.go
@@ -73,7 +73,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_ecr_repository"},
-		DefaultSeverity: severity.Info,
+		DefaultSeverity: severity.Low,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("encryption_configuration") {
@@ -81,7 +81,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not have CMK encryption configured", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Info),
+						WithSeverity(severity.Low),
 				)
 				return
 			}
@@ -92,7 +92,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' configures encryption without using CMK", resourceBlock.FullName())).
 						WithRange(encBlock.Range()).
-						WithSeverity(severity.Info),
+						WithSeverity(severity.Low),
 				)
 				return
 			}
@@ -102,7 +102,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should have the encryption type set to KMS", resourceBlock.FullName())).
 						WithRange(encBlock.Range()).
-						WithSeverity(severity.Info),
+						WithSeverity(severity.Low),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws094.go b/internal/app/tfsec/rules/aws094.go
index 8d52347f8..2e770a9a6 100644
--- a/internal/app/tfsec/rules/aws094.go
+++ b/internal/app/tfsec/rules/aws094.go
@@ -69,7 +69,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_redshift_cluster"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("encrypted") {
@@ -77,7 +77,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not have encryption enabled", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 				return
 			}
@@ -89,7 +89,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' has encryption explicitly disabled", resourceBlock.FullName())).
 						WithRange(encryptedAttr.Range()).
 						WithAttributeAnnotation(encryptedAttr).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 				return
 			}
@@ -99,7 +99,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not have a customer managed key specified", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/aws095.go b/internal/app/tfsec/rules/aws095.go
index 9e77ce56b..7a9b26690 100644
--- a/internal/app/tfsec/rules/aws095.go
+++ b/internal/app/tfsec/rules/aws095.go
@@ -58,7 +58,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_secretsmanager_secret"},
-		DefaultSeverity: severity.Info,
+		DefaultSeverity: severity.Low,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, ctx *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("kms_key_id") {
@@ -66,7 +66,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not use CMK", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Info),
+						WithSeverity(severity.Low),
 				)
 				return
 			}
@@ -84,7 +84,7 @@ func init() {
 							WithDescription(fmt.Sprintf("Resource '%s' explicitly uses the default CMK", resourceBlock.FullName())).
 							WithRange(kmsKeyAttr.Range()).
 							WithAttributeAnnotation(kmsKeyAttr).
-							WithSeverity(severity.Info),
+							WithSeverity(severity.Low),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws096.go b/internal/app/tfsec/rules/aws096.go
index 64777646f..eb1436fec 100644
--- a/internal/app/tfsec/rules/aws096.go
+++ b/internal/app/tfsec/rules/aws096.go
@@ -84,7 +84,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_ecs_task_definition"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("volume") {
@@ -102,7 +102,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' has efs configuration with in transit encryption implicitly disabled", resourceBlock.FullName())).
 							WithRange(resourceBlock.Range()).
-							WithSeverity(severity.Error),
+							WithSeverity(severity.High),
 					)
 					continue
 				}
@@ -113,7 +113,7 @@ func init() {
 							WithDescription(fmt.Sprintf("Resource '%s' has efs configuration with transit encryption explicitly disabled", resourceBlock.FullName())).
 							WithRange(transitAttr.Range()).
 							WithAttributeAnnotation(transitAttr).
-							WithSeverity(severity.Error),
+							WithSeverity(severity.High),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/aws097.go b/internal/app/tfsec/rules/aws097.go
index 8a81e13dd..631aea6b1 100644
--- a/internal/app/tfsec/rules/aws097.go
+++ b/internal/app/tfsec/rules/aws097.go
@@ -162,7 +162,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_iam_policy", "aws_iam_group_policy", "aws_iam_user_policy", "aws_iam_role_policy"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, ctx *hclcontext.Context) {
 
 			policyAttr := resourceBlock.GetAttribute("policy")
@@ -200,7 +200,7 @@ func init() {
 										WithDescription(fmt.Sprintf("Resource '%s' a policy with KMS actions for all KMS keys.", policyDocumentBlock.FullName())).
 										WithRange(resources.Range()).
 										WithAttributeAnnotation(resources).
-										WithSeverity(severity.Error),
+										WithSeverity(severity.High),
 								)
 							}
 						}
@@ -231,7 +231,7 @@ func checkAWS097PolicyJSON(set result.Set, resourceBlock block.Block, policyAttr
 							WithDescription(fmt.Sprintf("Resource '%s' a policy with KMS actions for all KMS keys.", resourceBlock.FullName())).
 							WithRange(policyAttr.Range()).
 							WithAttributeAnnotation(policyAttr).
-							WithSeverity(severity.Error),
+							WithSeverity(severity.High),
 					)
 					return
 				}
diff --git a/internal/app/tfsec/rules/aws098.go b/internal/app/tfsec/rules/aws098.go
index 611e9d6c1..b0c0b8872 100644
--- a/internal/app/tfsec/rules/aws098.go
+++ b/internal/app/tfsec/rules/aws098.go
@@ -55,7 +55,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_s3_bucket"},
-		DefaultSeverity: severity.Info,
+		DefaultSeverity: severity.Low,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, ctx *hclcontext.Context) {
 			blocks, err := ctx.GetReferencingResources(resourceBlock, "aws_s3_bucket_public_access_block", "bucket")
 			if err != nil || len(blocks) == 0 {
@@ -63,7 +63,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource %s has no associated aws_s3_bucket_public_access_block.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Info),
+						WithSeverity(severity.Low),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/aws099.go b/internal/app/tfsec/rules/aws099.go
index 9d23c5f93..11eaa9307 100644
--- a/internal/app/tfsec/rules/aws099.go
+++ b/internal/app/tfsec/rules/aws099.go
@@ -109,7 +109,7 @@ func init() {
 		Provider:        provider.AWSProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"aws_iam_policy", "aws_iam_user_policy", "aws_iam_group_policy", "aws_iam_role_policy"},
-		DefaultSeverity: severity.Info,
+		DefaultSeverity: severity.Low,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, ctx *hclcontext.Context) {
 			policyAttr := resourceBlock.GetAttribute("policy")
 			if policyAttr == nil {
diff --git a/internal/app/tfsec/rules/azu001.go b/internal/app/tfsec/rules/azu001.go
index 642013099..8dbf76dd8 100644
--- a/internal/app/tfsec/rules/azu001.go
+++ b/internal/app/tfsec/rules/azu001.go
@@ -60,7 +60,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_network_security_rule"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			directionAttr := resourceBlock.GetAttribute("direction")
@@ -80,7 +80,7 @@ func init() {
 								)).
 								WithRange(prefixAttr.Range()).
 								WithAttributeAnnotation(prefixAttr).
-								WithSeverity(severity.Warning),
+								WithSeverity(severity.Medium),
 						)
 					}
 				}
@@ -94,7 +94,7 @@ func init() {
 								WithDescription(fmt.Sprintf("Resource '%s' defines a fully open security group rule.", resourceBlock.FullName())).
 								WithRange(prefixesAttr.Range()).
 								WithAttributeAnnotation(prefixesAttr).
-								WithSeverity(severity.Warning),
+								WithSeverity(severity.Medium),
 						)
 					}
 				}
diff --git a/internal/app/tfsec/rules/azu002.go b/internal/app/tfsec/rules/azu002.go
index 658bb8309..4978314bc 100644
--- a/internal/app/tfsec/rules/azu002.go
+++ b/internal/app/tfsec/rules/azu002.go
@@ -60,7 +60,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_network_security_rule"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			directionAttr := resourceBlock.GetAttribute("direction")
@@ -80,7 +80,7 @@ func init() {
 								)).
 								WithRange(prefixAttr.Range()).
 								WithAttributeAnnotation(prefixAttr).
-								WithSeverity(severity.Warning),
+								WithSeverity(severity.Medium),
 						)
 					}
 				}
@@ -94,7 +94,7 @@ func init() {
 								WithDescription(fmt.Sprintf("Resource '%s' defines a fully open security group rule.", resourceBlock.FullName())).
 								WithRange(prefixesAttr.Range()).
 								WithAttributeAnnotation(prefixesAttr).
-								WithSeverity(severity.Warning),
+								WithSeverity(severity.Medium),
 						)
 					}
 				}
diff --git a/internal/app/tfsec/rules/azu003.go b/internal/app/tfsec/rules/azu003.go
index 61da6fccc..dd3dcc039 100644
--- a/internal/app/tfsec/rules/azu003.go
+++ b/internal/app/tfsec/rules/azu003.go
@@ -55,7 +55,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_managed_disk"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			encryptionSettingsBlock := resourceBlock.GetBlock("encryption_settings")
 			if encryptionSettingsBlock == nil {
@@ -72,7 +72,7 @@ func init() {
 						)).
 						WithRange(enabledAttr.Range()).
 						WithAttributeAnnotation(enabledAttr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/azu004.go b/internal/app/tfsec/rules/azu004.go
index 76617211e..ce34c2f9d 100644
--- a/internal/app/tfsec/rules/azu004.go
+++ b/internal/app/tfsec/rules/azu004.go
@@ -53,7 +53,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_data_lake_store"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			encryptionStateAttr := resourceBlock.GetAttribute("encryption_state")
@@ -66,7 +66,7 @@ func init() {
 						)).
 						WithRange(encryptionStateAttr.Range()).
 						WithAttributeAnnotation(encryptionStateAttr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/azu005.go b/internal/app/tfsec/rules/azu005.go
index c460f936a..1afd26128 100644
--- a/internal/app/tfsec/rules/azu005.go
+++ b/internal/app/tfsec/rules/azu005.go
@@ -57,7 +57,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_virtual_machine"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if linuxConfigBlock := resourceBlock.GetBlock("os_profile_linux_config"); linuxConfigBlock != nil {
@@ -71,7 +71,7 @@ func init() {
 							)).
 							WithRange(passwordAuthDisabledAttr.Range()).
 							WithAttributeAnnotation(passwordAuthDisabledAttr).
-							WithSeverity(severity.Error),
+							WithSeverity(severity.High),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/azu006.go b/internal/app/tfsec/rules/azu006.go
index 2182d03e7..2a0d49693 100644
--- a/internal/app/tfsec/rules/azu006.go
+++ b/internal/app/tfsec/rules/azu006.go
@@ -57,7 +57,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_kubernetes_cluster"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if networkProfileBlock := resourceBlock.GetBlock("network_profile"); networkProfileBlock != nil {
@@ -66,7 +66,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' do not have network_policy define. network_policy should be defined to have opportunity allow or block traffic to pods", resourceBlock.FullName())).
 							WithRange(networkProfileBlock.Range()).
-							WithSeverity(severity.Error),
+							WithSeverity(severity.High),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/azu007.go b/internal/app/tfsec/rules/azu007.go
index 63133c1ce..fe5f11abf 100644
--- a/internal/app/tfsec/rules/azu007.go
+++ b/internal/app/tfsec/rules/azu007.go
@@ -58,7 +58,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_kubernetes_cluster", "role_based_access_control"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			rbacBlock := resourceBlock.GetBlock("role_based_access_control")
@@ -67,7 +67,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines without RBAC", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -82,7 +82,7 @@ func init() {
 						)).
 						WithRange(enabledAttr.Range()).
 						WithAttributeAnnotation(enabledAttr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/azu008.go b/internal/app/tfsec/rules/azu008.go
index 4c948d9d4..2b825526e 100644
--- a/internal/app/tfsec/rules/azu008.go
+++ b/internal/app/tfsec/rules/azu008.go
@@ -55,7 +55,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_kubernetes_cluster"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if (resourceBlock.MissingChild("api_server_authorized_ip_ranges") ||
@@ -67,7 +67,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' defined without limited set of IP address ranges to the API server.", resourceBlock.FullName())).
 							WithRange(resourceBlock.Range()).
-							WithSeverity(severity.Error),
+							WithSeverity(severity.High),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/azu009.go b/internal/app/tfsec/rules/azu009.go
index 81932a6be..48079120e 100644
--- a/internal/app/tfsec/rules/azu009.go
+++ b/internal/app/tfsec/rules/azu009.go
@@ -58,7 +58,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_kubernetes_cluster"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			addonProfileBlock := resourceBlock.GetBlock("addon_profile")
@@ -67,7 +67,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' AKS logging to Azure Monitoring is not configured (missing addon_profile).", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -78,7 +78,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' AKS logging to Azure Monitoring is not configured (missing oms_agent).", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -91,7 +91,7 @@ func init() {
 						"Resource '%s' AKS logging to Azure Monitoring is not configured (oms_agent disabled).",
 						resourceBlock.FullName(),
 					)).
-					WithSeverity(severity.Error)
+					WithSeverity(severity.High)
 
 				if enabledAttr != nil {
 					res.WithRange(enabledAttr.Range()).
diff --git a/internal/app/tfsec/rules/azu010.go b/internal/app/tfsec/rules/azu010.go
index 4b6ce7d4a..b2228fa64 100644
--- a/internal/app/tfsec/rules/azu010.go
+++ b/internal/app/tfsec/rules/azu010.go
@@ -54,7 +54,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_storage_account", "enable_https_traffic_only"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			enabledAttr := resourceBlock.GetAttribute("enable_https_traffic_only")
@@ -67,7 +67,7 @@ func init() {
 						)).
 						WithRange(enabledAttr.Range()).
 						WithAttributeAnnotation(enabledAttr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/azu011.go b/internal/app/tfsec/rules/azu011.go
index 1e9397c29..7cffde3a0 100644
--- a/internal/app/tfsec/rules/azu011.go
+++ b/internal/app/tfsec/rules/azu011.go
@@ -67,7 +67,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azure_storage_container"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			// function contents here
@@ -80,7 +80,7 @@ func init() {
 							result.New(resourceBlock).
 								WithDescription(fmt.Sprintf("Resource '%s' defines publicAccess as '%s', should be 'off .", resourceBlock.FullName(), value)).
 								WithRange(resourceBlock.Range()).
-								WithSeverity(severity.Error),
+								WithSeverity(severity.High),
 						)
 					}
 				}
diff --git a/internal/app/tfsec/rules/azu012.go b/internal/app/tfsec/rules/azu012.go
index a4d9deaa3..2fecc2aca 100644
--- a/internal/app/tfsec/rules/azu012.go
+++ b/internal/app/tfsec/rules/azu012.go
@@ -63,7 +63,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_storage_account", "azurerm_storage_account_network_rules"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.IsResourceType("azurerm_storage_account") {
@@ -79,7 +79,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a default_action of Allow. It should be Deny.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/azu013.go b/internal/app/tfsec/rules/azu013.go
index a685ee9a1..a02b1a5a2 100644
--- a/internal/app/tfsec/rules/azu013.go
+++ b/internal/app/tfsec/rules/azu013.go
@@ -108,7 +108,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_storage_account_network_rules", "azurerm_storage_account"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.IsResourceType("azurerm_storage_account") {
@@ -125,7 +125,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' defines a network rule that doesn't allow bypass of Microsoft Services.", resourceBlock.FullName())).
 							WithRange(resourceBlock.Range()).
-							WithSeverity(severity.Error),
+							WithSeverity(severity.High),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/azu014.go b/internal/app/tfsec/rules/azu014.go
index 992e74089..e79b3c817 100644
--- a/internal/app/tfsec/rules/azu014.go
+++ b/internal/app/tfsec/rules/azu014.go
@@ -67,7 +67,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_storage_account"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.HasChild("enable_https_traffic_only") && resourceBlock.GetAttribute("enable_https_traffic_only").IsFalse() {
@@ -75,7 +75,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' explicitly turns off secure transfer to storage account.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/azu015.go b/internal/app/tfsec/rules/azu015.go
index de29d73df..f4b397376 100644
--- a/internal/app/tfsec/rules/azu015.go
+++ b/internal/app/tfsec/rules/azu015.go
@@ -62,7 +62,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_storage_account"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("min_tls_version") || resourceBlock.GetAttribute("min_tls_version").IsNone("TLS1_2") {
@@ -70,7 +70,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should have the min tls version set to TLS1_2 .", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/azu016.go b/internal/app/tfsec/rules/azu016.go
index 14faf81b0..bc16a941f 100644
--- a/internal/app/tfsec/rules/azu016.go
+++ b/internal/app/tfsec/rules/azu016.go
@@ -76,7 +76,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_storage_account"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.HasChild("queue_properties") {
@@ -86,7 +86,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' defines a Queue Services storage account without Storage Analytics logging.", resourceBlock.FullName())).
 							WithRange(resourceBlock.Range()).
-							WithSeverity(severity.Warning),
+							WithSeverity(severity.Medium),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/azu017.go b/internal/app/tfsec/rules/azu017.go
index 18ef7fa40..5661cb8fc 100644
--- a/internal/app/tfsec/rules/azu017.go
+++ b/internal/app/tfsec/rules/azu017.go
@@ -96,7 +96,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_network_security_group", "azurerm_network_security_rule"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			var securityRules block.Blocks
@@ -117,7 +117,7 @@ func init() {
 								result.New(resourceBlock).
 									WithDescription(fmt.Sprintf("Resource '%s' has a .", resourceBlock.FullName())).
 									WithRange(resourceBlock.Range()).
-									WithSeverity(severity.Error),
+									WithSeverity(severity.High),
 							)
 						}
 					}
diff --git a/internal/app/tfsec/rules/azu018.go b/internal/app/tfsec/rules/azu018.go
index 874f24704..2f03812d3 100644
--- a/internal/app/tfsec/rules/azu018.go
+++ b/internal/app/tfsec/rules/azu018.go
@@ -71,7 +71,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_sql_server", "azurerm_mssql_server"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, ctx *hclcontext.Context) {
 
 			if !resourceBlock.MissingChild("extended_auditing_policy") {
@@ -92,7 +92,7 @@ func init() {
 				result.New(resourceBlock).
 					WithDescription(fmt.Sprintf("Resource '%s' does not have an extended audit policy configured.", resourceBlock.FullName())).
 					WithRange(resourceBlock.Range()).
-					WithSeverity(severity.Error),
+					WithSeverity(severity.High),
 			)
 
 		},
diff --git a/internal/app/tfsec/rules/azu019.go b/internal/app/tfsec/rules/azu019.go
index 148b3ccf4..945f699e8 100644
--- a/internal/app/tfsec/rules/azu019.go
+++ b/internal/app/tfsec/rules/azu019.go
@@ -72,7 +72,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_sql_server", "azurerm_sql_server", "azurerm_mssql_database_extended_auditing_policy"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			if !resourceBlock.IsResourceType("azurerm_mssql_database_extended_auditing_policy") {
 				if resourceBlock.MissingChild("extended_auditing_policy") {
@@ -90,7 +90,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' specifies a retention period of less than 90 days.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/azu020.go b/internal/app/tfsec/rules/azu020.go
index 0b909764a..3ea2fc3bd 100644
--- a/internal/app/tfsec/rules/azu020.go
+++ b/internal/app/tfsec/rules/azu020.go
@@ -68,7 +68,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_key_vault"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("network_acls") {
@@ -76,7 +76,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' specifies does not specify a network acl block.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -87,7 +87,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' specifies does not specify a network acl block.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -97,7 +97,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' specifies does not specify a default action in the network acl.", resourceBlock.FullName())).
 						WithRange(networkAcls.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -109,7 +109,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' specifies does not specify a network acl block.", resourceBlock.FullName())).
 						WithRange(defaultActionAttr.Range()).
 						WithAttributeAnnotation(defaultActionAttr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/azu021.go b/internal/app/tfsec/rules/azu021.go
index a3d2c0fd7..13123e7be 100644
--- a/internal/app/tfsec/rules/azu021.go
+++ b/internal/app/tfsec/rules/azu021.go
@@ -62,7 +62,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_key_vault"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("purge_protection_enabled") || resourceBlock.GetAttribute("purge_protection_enabled").IsFalse() {
@@ -70,7 +70,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should have purge protection enabled.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 				return
 			}
@@ -79,7 +79,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should have soft_delete_retention_days set in order to enabled purge protection.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/azu022.go b/internal/app/tfsec/rules/azu022.go
index cc0e33b55..d78484ec0 100644
--- a/internal/app/tfsec/rules/azu022.go
+++ b/internal/app/tfsec/rules/azu022.go
@@ -60,7 +60,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_key_vault_secret"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("content_type") {
@@ -68,7 +68,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should have a content type set.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/azu023.go b/internal/app/tfsec/rules/azu023.go
index f69673546..6c8ac03b8 100644
--- a/internal/app/tfsec/rules/azu023.go
+++ b/internal/app/tfsec/rules/azu023.go
@@ -60,7 +60,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_key_vault_secret"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("expiration_date") {
@@ -68,7 +68,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should have an expiration date set.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/azu024.go b/internal/app/tfsec/rules/azu024.go
index a0444b610..aab4e4c0b 100644
--- a/internal/app/tfsec/rules/azu024.go
+++ b/internal/app/tfsec/rules/azu024.go
@@ -97,7 +97,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_network_security_group", "azurerm_network_security_rule"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			var securityRules block.Blocks
@@ -118,7 +118,7 @@ func init() {
 								result.New(resourceBlock).
 									WithDescription(fmt.Sprintf("Resource '%s' has a source address prefix of *, 0.0.0.0, /0, internet or an any. Consider using the Azure Bastion Service.", resourceBlock.FullName())).
 									WithRange(resourceBlock.Range()).
-									WithSeverity(severity.Error),
+									WithSeverity(severity.High),
 							)
 						}
 					}
diff --git a/internal/app/tfsec/rules/azu025.go b/internal/app/tfsec/rules/azu025.go
index 1774923ee..a41470d5d 100644
--- a/internal/app/tfsec/rules/azu025.go
+++ b/internal/app/tfsec/rules/azu025.go
@@ -60,7 +60,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_data_factory"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("public_network_enabled") {
@@ -68,7 +68,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should have public_network_enabled set to false, the default is true.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -77,7 +77,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should not have public network set to true.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/azu026.go b/internal/app/tfsec/rules/azu026.go
index f1ddd4361..591ecf51c 100644
--- a/internal/app/tfsec/rules/azu026.go
+++ b/internal/app/tfsec/rules/azu026.go
@@ -80,7 +80,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_key_vault_key"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("expiration_date") {
@@ -88,7 +88,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should have an expiration date set.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/azu027.go b/internal/app/tfsec/rules/azu027.go
index 5a42d1bde..e4c9f749c 100644
--- a/internal/app/tfsec/rules/azu027.go
+++ b/internal/app/tfsec/rules/azu027.go
@@ -87,7 +87,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_synapse_workspace"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("managed_virtual_network_enabled") {
@@ -95,7 +95,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should have managed_virtual_network_enabled set to true, the default is false.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -106,7 +106,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' should have managed_virtual_network_enabled set to true, the default is false.", resourceBlock.FullName())).
 						WithRange(managedNetworkAttr.Range()).
 						WithAttributeAnnotation(managedNetworkAttr).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/azu028.go b/internal/app/tfsec/rules/azu028.go
index c43f40fa7..33138d78d 100644
--- a/internal/app/tfsec/rules/azu028.go
+++ b/internal/app/tfsec/rules/azu028.go
@@ -67,7 +67,7 @@ func init() {
 		Provider:        provider.AzureProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_function_app"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("https_only") {
@@ -75,7 +75,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' should have https_only set to true, the default is false.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -86,7 +86,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' should have https_only set to true, the default is false.", resourceBlock.FullName())).
 						WithRange(httpsOnlyAttr.Range()).
 						WithAttributeAnnotation(httpsOnlyAttr).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/dig001.go b/internal/app/tfsec/rules/dig001.go
index 9a99c5fc4..f1f454cf2 100644
--- a/internal/app/tfsec/rules/dig001.go
+++ b/internal/app/tfsec/rules/dig001.go
@@ -64,7 +64,7 @@ func init() {
 		Provider:        provider.DigitalOceanProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"digitalocean_firewall"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			inboundBlocks := resourceBlock.GetBlocks("inbound_rule")
@@ -80,7 +80,7 @@ func init() {
 							WithDescription(fmt.Sprintf("Resource '%s' defines a fully open inbound_rule.", resourceBlock.FullName())).
 							WithRange(sourceAddressesAttr.Range()).
 							WithAttributeAnnotation(sourceAddressesAttr).
-							WithSeverity(severity.Warning),
+							WithSeverity(severity.Medium),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/dig002.go b/internal/app/tfsec/rules/dig002.go
index 2e7da3706..30822f62f 100644
--- a/internal/app/tfsec/rules/dig002.go
+++ b/internal/app/tfsec/rules/dig002.go
@@ -64,7 +64,7 @@ func init() {
 		Provider:        provider.DigitalOceanProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"digitalocean_firewall"},
-		DefaultSeverity: severity.Warning, //TODO set the default severity
+		DefaultSeverity: severity.Medium, //TODO set the default severity
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			inboundBlocks := resourceBlock.GetBlocks("outbound_rule")
 
@@ -79,7 +79,7 @@ func init() {
 							WithDescription(fmt.Sprintf("Resource '%s' defines a fully open outbound_rule.", resourceBlock.FullName())).
 							WithRange(destinationAddressesAttr.Range()).
 							WithAttributeAnnotation(destinationAddressesAttr).
-							WithSeverity(severity.Warning),
+							WithSeverity(severity.Medium),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/dig003.go b/internal/app/tfsec/rules/dig003.go
index 63bc8da99..7a80bf280 100644
--- a/internal/app/tfsec/rules/dig003.go
+++ b/internal/app/tfsec/rules/dig003.go
@@ -59,7 +59,7 @@ func init() {
 		Provider:        provider.DigitalOceanProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"digitalocean_droplet"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("ssh_keys") {
@@ -67,7 +67,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not define ssh_keys", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 				return
 			}
@@ -78,7 +78,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' has ssh_key specified but is empty.", resourceBlock.FullName())).
 						WithRange(sshKeysAttr.Range()).
 						WithAttributeAnnotation(sshKeysAttr).
-						WithSeverity(severity.Warning),
+						WithSeverity(severity.Medium),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/dig004.go b/internal/app/tfsec/rules/dig004.go
index 066b2738c..b750487d6 100644
--- a/internal/app/tfsec/rules/dig004.go
+++ b/internal/app/tfsec/rules/dig004.go
@@ -72,7 +72,7 @@ func init() {
 		Provider:        provider.DigitalOceanProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"digitalocean_loadbalancer"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("forwarding_rule") {
@@ -88,7 +88,7 @@ func init() {
 				if entryPointAttr.Equals("http", block.IgnoreCase) {
 					set.Add(result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' uses plain HTTP instead of HTTPS.", resourceBlock.FullName())).
-						WithSeverity(severity.Error).
+						WithSeverity(severity.High).
 						WithAttributeAnnotation(entryPointAttr).
 						WithRange(entryPointAttr.Range()))
 				}
diff --git a/internal/app/tfsec/rules/dig005.go b/internal/app/tfsec/rules/dig005.go
index 9608afe48..f6c99dace 100644
--- a/internal/app/tfsec/rules/dig005.go
+++ b/internal/app/tfsec/rules/dig005.go
@@ -70,7 +70,7 @@ func init() {
 		Provider:        provider.DigitalOceanProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"digitalocean_spaces_bucket", "digitalocean_spaces_bucket_object"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.HasChild("acl") {
@@ -78,7 +78,7 @@ func init() {
 				if aclAttr.Equals("public-read", block.IgnoreCase) {
 					set.Add(result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has a publicly readable acl.", resourceBlock.FullName())).
-						WithSeverity(severity.Warning).
+						WithSeverity(severity.Medium).
 						WithAttributeAnnotation(aclAttr).
 						WithRange(aclAttr.Range()))
 				}
diff --git a/internal/app/tfsec/rules/dig006.go b/internal/app/tfsec/rules/dig006.go
index 1dd8eb9b3..2b3a57539 100644
--- a/internal/app/tfsec/rules/dig006.go
+++ b/internal/app/tfsec/rules/dig006.go
@@ -63,13 +63,13 @@ func init() {
 		Provider:        provider.DigitalOceanProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"digitalocean_spaces_bucket"},
-		DefaultSeverity: severity.Warning, //TODO set the default severity
+		DefaultSeverity: severity.Medium, //TODO set the default severity
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("versioning") {
 				set.Add(result.New(resourceBlock).
 					WithDescription(fmt.Sprintf("Resource '%s' does not have versioning enabled.", resourceBlock.FullName())).
-					WithSeverity(severity.Warning).
+					WithSeverity(severity.Medium).
 					WithRange(resourceBlock.Range()))
 
 				return
@@ -81,7 +81,7 @@ func init() {
 			if enabledAttr == nil || enabledAttr.IsFalse() {
 				set.Add(result.New(resourceBlock).
 					WithDescription(fmt.Sprintf("Resource '%s' has versioning specified, but it isn't enabled", resourceBlock.FullName())).
-					WithSeverity(severity.Warning).
+					WithSeverity(severity.Medium).
 					WithAttributeAnnotation(enabledAttr).
 					WithRange(enabledAttr.Range()))
 
diff --git a/internal/app/tfsec/rules/dig007.go b/internal/app/tfsec/rules/dig007.go
index dc9169ae9..206d65cff 100644
--- a/internal/app/tfsec/rules/dig007.go
+++ b/internal/app/tfsec/rules/dig007.go
@@ -50,14 +50,14 @@ func init() {
 		Provider:        provider.DigitalOceanProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"digitalocean_spaces_bucket"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			if resourceBlock.HasChild("force_destroy") {
 				forceDestroyAttr := resourceBlock.GetAttribute("force_destroy")
 				if forceDestroyAttr.IsTrue() {
 					set.Add(result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' has versioning specified, but it isn't enabled", resourceBlock.FullName())).
-						WithSeverity(severity.Warning).
+						WithSeverity(severity.Medium).
 						WithAttributeAnnotation(forceDestroyAttr).
 						WithRange(forceDestroyAttr.Range()))
 				}
diff --git a/internal/app/tfsec/rules/gcp001.go b/internal/app/tfsec/rules/gcp001.go
index 84b5d5b5a..0a7f0c3d1 100644
--- a/internal/app/tfsec/rules/gcp001.go
+++ b/internal/app/tfsec/rules/gcp001.go
@@ -57,7 +57,7 @@ func init() {
 		Provider:        provider.GCPProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"google_compute_disk"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			keyBlock := resourceBlock.GetBlock("disk_encryption_key")
@@ -66,7 +66,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a disk encrypted with an auto-generated key.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/rules/gcp003.go b/internal/app/tfsec/rules/gcp003.go
index 520b8c337..e2acd180c 100644
--- a/internal/app/tfsec/rules/gcp003.go
+++ b/internal/app/tfsec/rules/gcp003.go
@@ -53,7 +53,7 @@ func init() {
 		Provider:        provider.GCPProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"google_compute_firewall"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if sourceRanges := resourceBlock.GetAttribute("source_ranges"); sourceRanges != nil {
@@ -62,7 +62,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' defines a fully open inbound firewall rule.", resourceBlock.FullName())).
 							WithRange(sourceRanges.Range()).
-							WithSeverity(severity.Warning),
+							WithSeverity(severity.Medium),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/gcp004.go b/internal/app/tfsec/rules/gcp004.go
index 37cd65d48..a56f76174 100644
--- a/internal/app/tfsec/rules/gcp004.go
+++ b/internal/app/tfsec/rules/gcp004.go
@@ -53,7 +53,7 @@ func init() {
 		Provider:        provider.GCPProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"google_compute_firewall"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if destinationRanges := resourceBlock.GetAttribute("destination_ranges"); destinationRanges != nil {
@@ -63,7 +63,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' defines a fully open outbound firewall rule.", resourceBlock.FullName())).
 							WithRange(destinationRanges.Range()).
-							WithSeverity(severity.Warning),
+							WithSeverity(severity.Medium),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/gcp005.go b/internal/app/tfsec/rules/gcp005.go
index 461ccfa80..c45f328f8 100644
--- a/internal/app/tfsec/rules/gcp005.go
+++ b/internal/app/tfsec/rules/gcp005.go
@@ -59,7 +59,7 @@ func init() {
 		Provider:        provider.GCPProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"google_container_cluster"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			enableLegacyABAC := resourceBlock.GetAttribute("enable_legacy_abac")
@@ -68,7 +68,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a cluster with ABAC enabled. Disable and rely on RBAC instead. ", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/gcp006.go b/internal/app/tfsec/rules/gcp006.go
index 1c623f4c9..a495a85ef 100644
--- a/internal/app/tfsec/rules/gcp006.go
+++ b/internal/app/tfsec/rules/gcp006.go
@@ -64,7 +64,7 @@ func init() {
 		Provider:        provider.GCPProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"google_container_cluster", "google_container_node_pool"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("node_config") {
@@ -88,7 +88,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a cluster with node metadata exposed. node_metadata set to EXPOSE or UNSPECIFIED disables metadata concealment. ", resourceBlock.FullName())).
 						WithRange(nodeMetadata.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/gcp007.go b/internal/app/tfsec/rules/gcp007.go
index 6aeaa4cb8..cb08bbc7d 100644
--- a/internal/app/tfsec/rules/gcp007.go
+++ b/internal/app/tfsec/rules/gcp007.go
@@ -61,7 +61,7 @@ func init() {
 		Provider:        provider.GCPProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"google_container_cluster"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("metadata") {
@@ -74,7 +74,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a cluster with legacy metadata endpoints enabled.", resourceBlock.FullName())).
 						WithRange(legacyMetadataAPI.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/gcp008.go b/internal/app/tfsec/rules/gcp008.go
index 755133d17..9e57fafba 100644
--- a/internal/app/tfsec/rules/gcp008.go
+++ b/internal/app/tfsec/rules/gcp008.go
@@ -67,7 +67,7 @@ func init() {
 		Provider:        provider.GCPProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"google_container_cluster"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			masterAuthBlock := resourceBlock.GetBlock("master_auth")
@@ -76,7 +76,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not disable basic auth with static passwords for client authentication. Disable this with a master_auth block container empty strings for user and password.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -87,7 +87,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a cluster using basic auth with static passwords for client authentication. It is recommended to use OAuth or service accounts instead.", resourceBlock.FullName())).
 						WithRange(masterAuthBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
@@ -101,7 +101,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a cluster using basic auth with client certificates for authentication. This cert has no permissions if RBAC is enabled and ABAC is disabled. It is recommended to use OAuth or service accounts instead.", resourceBlock.FullName())).
 						WithRange(issueClientCert.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/gcp009.go b/internal/app/tfsec/rules/gcp009.go
index edea523bf..ad6c6cbe0 100644
--- a/internal/app/tfsec/rules/gcp009.go
+++ b/internal/app/tfsec/rules/gcp009.go
@@ -61,7 +61,7 @@ func init() {
 		Provider:        provider.GCPProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"google_container_cluster"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			pspBlock := resourceBlock.GetBlock("pod_security_policy_config")
@@ -70,7 +70,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a cluster with no Pod Security Policy config defined. It is recommended to define a PSP for your pods and enable PSP enforcement.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -81,7 +81,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a cluster with Pod Security Policy enforcement disabled. It is recommended to define a PSP for your pods and enable PSP enforcement.", resourceBlock.FullName())).
 						WithRange(enforcePSP.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/gcp010.go b/internal/app/tfsec/rules/gcp010.go
index 22c3431c7..df8422294 100644
--- a/internal/app/tfsec/rules/gcp010.go
+++ b/internal/app/tfsec/rules/gcp010.go
@@ -53,7 +53,7 @@ func init() {
 		Provider:        provider.GCPProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"google_container_cluster"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if resourceBlock.MissingChild("enable_shielded_nodes") {
@@ -61,7 +61,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a cluster with shielded nodes disabled. Shielded GKE Nodes provide strong, verifiable node identity and integrity to increase the security of GKE nodes and should be enabled on all GKE clusters.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -72,7 +72,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' defines a cluster with shielded nodes disabled. Shielded GKE Nodes provide strong, verifiable node identity and integrity to increase the security of GKE nodes and should be enabled on all GKE clusters.", resourceBlock.FullName())).
 						WithRange(enableShieldedNodesAttr.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/gcp011.go b/internal/app/tfsec/rules/gcp011.go
index 0f322e002..cd27e34e9 100644
--- a/internal/app/tfsec/rules/gcp011.go
+++ b/internal/app/tfsec/rules/gcp011.go
@@ -98,7 +98,7 @@ func init() {
 			"google_storage_bucket_iam_member",
 			"google_iam_policy",
 		},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			var members []cty.Value
@@ -119,7 +119,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("'%s' grants IAM to a user object. It is recommended to manage user permissions with groups.", resourceBlock.FullName())).
 							WithRange(attribute.Range()).
-							WithSeverity(severity.Warning),
+							WithSeverity(severity.Medium),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/gcp012.go b/internal/app/tfsec/rules/gcp012.go
index e6c9eb447..8c6e0669a 100644
--- a/internal/app/tfsec/rules/gcp012.go
+++ b/internal/app/tfsec/rules/gcp012.go
@@ -57,7 +57,7 @@ func init() {
 		Provider:        provider.GCPProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"google_container_cluster", "google_container_node_pool"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if strings.HasPrefix(resourceBlock.Label(), "google_container_cluster") {
@@ -72,7 +72,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not define the node config and does not override the default service account. It is recommended to use a minimally privileged service account to run your GKE cluster.", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -85,7 +85,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' does not override the default service account. It is recommended to use a minimally privileged service account to run your GKE cluster.", resourceBlock.FullName())).
 						WithRange(nodeConfigBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/gcp013.go b/internal/app/tfsec/rules/gcp013.go
index e20aa9a9a..dcbc6067d 100644
--- a/internal/app/tfsec/rules/gcp013.go
+++ b/internal/app/tfsec/rules/gcp013.go
@@ -52,7 +52,7 @@ func init() {
 		Provider:        provider.GCPProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"google_compute_disk"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			keyBlock := resourceBlock.GetBlock("disk_encryption_key")
@@ -71,7 +71,7 @@ func init() {
 						WithDescription(fmt.Sprintf("Resource '%s' specifies an encryption key in raw format.", resourceBlock.FullName())).
 						WithRange(rawKeyAttr.Range()).
 						WithAttributeAnnotation(rawKeyAttr).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			}
 
diff --git a/internal/app/tfsec/rules/gen001.go b/internal/app/tfsec/rules/gen001.go
index 4af3b37db..2bcf54f9d 100644
--- a/internal/app/tfsec/rules/gen001.go
+++ b/internal/app/tfsec/rules/gen001.go
@@ -68,7 +68,7 @@ func init() {
 		},
 		Provider:        provider.GeneralProvider,
 		RequiredTypes:   []string{"variable"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			if len(resourceBlock.Labels()) == 0 || !security.IsSensitiveAttribute(resourceBlock.TypeLabel()) {
@@ -82,7 +82,7 @@ func init() {
 							WithDescription(fmt.Sprintf("Variable '%s' includes a potentially sensitive default value.", resourceBlock.FullName())).
 							WithRange(attribute.Range()).
 							WithAttributeAnnotation(attribute).
-							WithSeverity(severity.Warning),
+							WithSeverity(severity.Medium),
 						)
 					}
 				}
diff --git a/internal/app/tfsec/rules/gen002.go b/internal/app/tfsec/rules/gen002.go
index f94f886a4..8796162ed 100644
--- a/internal/app/tfsec/rules/gen002.go
+++ b/internal/app/tfsec/rules/gen002.go
@@ -60,7 +60,7 @@ func init() {
 		},
 		Provider:        provider.GeneralProvider,
 		RequiredTypes:   []string{"locals"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			for _, attribute := range resourceBlock.GetAttributes() {
@@ -70,7 +70,7 @@ func init() {
 							WithDescription(fmt.Sprintf("Local '%s' includes a potentially sensitive value which is defined within the project.", resourceBlock.FullName())).
 							WithRange(attribute.Range()).
 							WithAttributeAnnotation(attribute).
-							WithSeverity(severity.Warning),
+							WithSeverity(severity.Medium),
 						)
 					}
 				}
diff --git a/internal/app/tfsec/rules/gen003.go b/internal/app/tfsec/rules/gen003.go
index 1f2a441b9..3153ba368 100644
--- a/internal/app/tfsec/rules/gen003.go
+++ b/internal/app/tfsec/rules/gen003.go
@@ -87,7 +87,7 @@ func init() {
 		},
 		Provider:        provider.GeneralProvider,
 		RequiredTypes:   []string{"resource", "provider", "module"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			attributes := resourceBlock.GetAttributes()
@@ -105,7 +105,7 @@ func init() {
 							WithDescription(fmt.Sprintf("Block '%s' includes a potentially sensitive attribute which is defined within the project.", resourceBlock.FullName())).
 							WithRange(attribute.Range()).
 							WithAttributeAnnotation(attribute).
-							WithSeverity(severity.Warning),
+							WithSeverity(severity.Medium),
 						)
 					}
 
diff --git a/internal/app/tfsec/rules/gen004.go b/internal/app/tfsec/rules/gen004.go
index d06177e39..2b41141d9 100644
--- a/internal/app/tfsec/rules/gen004.go
+++ b/internal/app/tfsec/rules/gen004.go
@@ -72,7 +72,7 @@ func init() {
 		Provider:        provider.GeneralProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"github_repository"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			privateAttribute := resourceBlock.GetAttribute("private")
@@ -82,7 +82,7 @@ func init() {
 					result.New(resourceBlock).
 						WithDescription(fmt.Sprintf("Resource '%s' is missing both of `private` or `visibility` attributes - one of these is required to make repository private", resourceBlock.FullName())).
 						WithRange(resourceBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 				return
 			}
@@ -95,7 +95,7 @@ func init() {
 							WithDescription(fmt.Sprintf("Resource '%s' has visibility set to public - visibility should be set to `private` or `internal` to make repository private", resourceBlock.FullName())).
 							WithRange(visibilityAttribute.Range()).
 							WithAttributeAnnotation(visibilityAttribute).
-							WithSeverity(severity.Error),
+							WithSeverity(severity.High),
 					)
 				}
 				// stop here as visibility parameter trumps the private one
@@ -110,7 +110,7 @@ func init() {
 						result.New(resourceBlock).
 							WithDescription(fmt.Sprintf("Resource '%s' has private set to false - it should be set to `true` to make repository private", resourceBlock.FullName())).
 							WithRange(privateAttribute.Range()).
-							WithSeverity(severity.Error),
+							WithSeverity(severity.High),
 					)
 				}
 			}
diff --git a/internal/app/tfsec/rules/gen005.go b/internal/app/tfsec/rules/gen005.go
index bd0ef9a25..c06488b69 100644
--- a/internal/app/tfsec/rules/gen005.go
+++ b/internal/app/tfsec/rules/gen005.go
@@ -63,7 +63,7 @@ func init() {
 		Provider:        provider.GeneralProvider,
 		RequiredTypes:   []string{"resource", "provider", "module", "locals", "variable"},
 		RequiredLabels:  []string{"*"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 
 			attributes := resourceBlock.GetAttributes()
@@ -76,7 +76,7 @@ func init() {
 								WithDescription(fmt.Sprintf("Block '%s' includes potentially sensitive data. %s", resourceBlock.FullName(), scanResult.Description)).
 								WithRange(attribute.Range()).
 								WithAttributeAnnotation(attribute).
-								WithSeverity(severity.Warning),
+								WithSeverity(severity.Medium),
 						)
 					}
 				}
diff --git a/internal/app/tfsec/rules/oci001.go b/internal/app/tfsec/rules/oci001.go
index 39153000f..71f8ded3c 100644
--- a/internal/app/tfsec/rules/oci001.go
+++ b/internal/app/tfsec/rules/oci001.go
@@ -57,7 +57,7 @@ func init() {
 		Provider:        provider.OracleProvider,
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"opc_compute_ip_address_reservation"},
-		DefaultSeverity: severity.Warning,
+		DefaultSeverity: severity.Medium,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			if attr := resourceBlock.GetAttribute("ip_address_pool"); attr != nil {
 				if attr.Equals("public-ippool") {
@@ -66,7 +66,7 @@ func init() {
 							WithDescription(fmt.Sprintf("Resource '%s' is using an IP from a public IP pool", resourceBlock.FullName())).
 							WithRange(attr.Range()).
 							WithAttributeAnnotation(attr).
-							WithSeverity(severity.Warning),
+							WithSeverity(severity.Medium),
 					)
 				}
 			}
diff --git a/pkg/severity/severity.go b/pkg/severity/severity.go
index 759345909..bc0a5c2b0 100644
--- a/pkg/severity/severity.go
+++ b/pkg/severity/severity.go
@@ -5,13 +5,13 @@ type Severity string
 const (
 	None     Severity = ""
 	Critical Severity = "CRITICAL"
-	Error    Severity = "ERROR"
-	Warning  Severity = "WARNING"
-	Info     Severity = "INFO"
+	High     Severity = "HIGH"
+	Medium   Severity = "MEDIUM"
+	Low      Severity = "LOW"
 )
 
 var ValidSeverity = []Severity{
-	Critical, Error, Warning, Info,
+	Critical, High, Medium, Low,
 }
 
 func (s *Severity) IsValid() bool {


Test patch:
diff --git a/cmd/tfsec/main_test.go b/cmd/tfsec/main_test.go
index e71b476a2..b3837f389 100644
--- a/cmd/tfsec/main_test.go
+++ b/cmd/tfsec/main_test.go
@@ -15,11 +15,11 @@ func Test_IfIgnoreWarningsSetShouldRemoveWarningScanResults(t *testing.T) {
 	twoScanResultsWithOneWarning := []result.Result{
 		{
 			RuleID:   "1",
-			Severity: severity.Error,
+			Severity: severity.High,
 		},
 		{
 			RuleID:   "2",
-			Severity: severity.Warning,
+			Severity: severity.Medium,
 		},
 	}
 
@@ -32,11 +32,11 @@ func Test_IfIgnoreWarningsIsNotSetThenWarningShouldBeInScanResults(t *testing.T)
 	twoScanResultsWithOneWarning := []result.Result{
 		{
 			RuleID:   "1",
-			Severity: severity.Error,
+			Severity: severity.High,
 		},
 		{
 			RuleID:   "2",
-			Severity: severity.Warning,
+			Severity: severity.Medium,
 		},
 	}
 
diff --git a/internal/app/tfsec/config/config_test.go b/internal/app/tfsec/config/config_test.go
index c33b8cbfc..8351011ff 100644
--- a/internal/app/tfsec/config/config_test.go
+++ b/internal/app/tfsec/config/config_test.go
@@ -14,7 +14,7 @@ import (
 func TestExcludesElementsFromYAML(t *testing.T) {
 	content := `
 severity_overrides:
-  AWS018: INFO
+  AWS018: LOW
 
 exclude:
   - DP001
@@ -28,7 +28,7 @@ exclude:
 func TestExcludesElementsFromYML(t *testing.T) {
 	content := `
 severity_overrides:
-  AWS018: INFO
+  AWS018: LOW
 
 exclude:
   - DP001
@@ -42,7 +42,7 @@ exclude:
 func TestExcludesElementsFromJSON(t *testing.T) {
 	content := `{
   "severity_overrides": {
-    "AWS018": "INFO"
+    "AWS018": "LOW"
   },
   "exclude": [
     "DP001"
@@ -55,6 +55,23 @@ func TestExcludesElementsFromJSON(t *testing.T) {
 	assert.Contains(t, c.ExcludedChecks, "DP001")
 }
 
+func TestWarningIsRewrittenAsMedium(t *testing.T) {
+	content := `{
+  "severity_overrides": {
+    "AWS018": "WARNING"
+  },
+  "exclude": [
+    "DP001"
+  ]
+}
+`
+	c := load(t, "config.json", content)
+
+	assert.Contains(t, c.SeverityOverrides, "AWS018")
+	sev := c.SeverityOverrides["AWS018"]
+	assert.Equal(t, "MEDIUM", sev)
+}
+
 func load(t *testing.T, filename, content string) *config.Config {
 	dir, err := ioutil.TempDir("", "")
 	require.NoError(t, err)
diff --git a/internal/app/tfsec/custom/check_all_statements_test.go b/internal/app/tfsec/custom/check_all_statements_test.go
index a0b632a3a..78541de48 100644
--- a/internal/app/tfsec/custom/check_all_statements_test.go
+++ b/internal/app/tfsec/custom/check_all_statements_test.go
@@ -17,7 +17,7 @@ func init() {
       "requiredLabels": [
         "aws_iam_policy_document"
       ],
-      "severity": "ERROR",
+      "severity": "HIGH",
       "matchSpec": {
         "name": "statement",
         "action": "isPresent",
@@ -38,7 +38,7 @@ func init() {
       "requiredLabels": [
         "imaginary_resource"
       ],
-      "severity": "ERROR",
+      "severity": "HIGH",
       "matchSpec": {
         "name": "statement",
         "action": "isPresent",
diff --git a/internal/app/tfsec/custom/multiple_submatches_test.go b/internal/app/tfsec/custom/multiple_submatches_test.go
index 20f4a68c7..756213c1b 100644
--- a/internal/app/tfsec/custom/multiple_submatches_test.go
+++ b/internal/app/tfsec/custom/multiple_submatches_test.go
@@ -17,7 +17,7 @@ func init() {
       "requiredLabels": [
         "aws_instance"
       ],
-      "severity": "ERROR",
+      "severity": "HIGH",
       "matchSpec": {
         "name": "metadata_options",
         "action": "isPresent",
diff --git a/internal/app/tfsec/custom/processing_test.go b/internal/app/tfsec/custom/processing_test.go
index 28fff6626..6f4ea03b7 100644
--- a/internal/app/tfsec/custom/processing_test.go
+++ b/internal/app/tfsec/custom/processing_test.go
@@ -29,7 +29,7 @@ func init() {
       "requiredLabels": [
         "aws_vpc"
       ],
-      "severity": "ERROR",
+      "severity": "HIGH",
       "matchSpec": {
         "action": "requiresPresence",
 		"name": "aws_flow_log"
diff --git a/internal/app/tfsec/test/aws080_test.go b/internal/app/tfsec/test/aws080_test.go
index 01e1dbef4..455057453 100644
--- a/internal/app/tfsec/test/aws080_test.go
+++ b/internal/app/tfsec/test/aws080_test.go
@@ -128,7 +128,7 @@ resource "aws_codebuild_project" "codebuild" {
 `, t)
 		for _, result := range results {
 			if result.RuleID == rules.AWSCodeBuildProjectEncryptionNotDisabled {
-				assert.True(t, result.Severity == severity.Warning, fmt.Sprintf("Result with code '%s' had wrong Severity reported '%s'", result.RuleID, result.Severity))
+				assert.True(t, result.Severity == severity.Medium, fmt.Sprintf("Result with code '%s' had wrong Severity reported '%s'", result.RuleID, result.Severity))
 			}
 		}
 	})
diff --git a/internal/app/tfsec/test/ignore_test.go b/internal/app/tfsec/test/ignore_test.go
index 8a136eaab..f51a1b404 100644
--- a/internal/app/tfsec/test/ignore_test.go
+++ b/internal/app/tfsec/test/ignore_test.go
@@ -71,10 +71,10 @@ func Test_IgnoreSpecific(t *testing.T) {
 	scanner.RegisterCheckRule(rule.Rule{
 		ID:              "ABC123",
 		RequiredLabels:  []string{"bad"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			set.Add(
-				result.New(resourceBlock).WithDescription("example problem").WithRange(resourceBlock.Range()).WithSeverity(severity.Error),
+				result.New(resourceBlock).WithDescription("example problem").WithRange(resourceBlock.Range()).WithSeverity(severity.High),
 			)
 		},
 	})
@@ -82,10 +82,10 @@ func Test_IgnoreSpecific(t *testing.T) {
 	scanner.RegisterCheckRule(rule.Rule{
 		ID:              "DEF456",
 		RequiredLabels:  []string{"bad"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			set.Add(
-				result.New(resourceBlock).WithDescription("example problem").WithRange(resourceBlock.Range()).WithSeverity(severity.Error),
+				result.New(resourceBlock).WithDescription("example problem").WithRange(resourceBlock.Range()).WithSeverity(severity.High),
 			)
 		},
 	})
diff --git a/internal/app/tfsec/test/setup_test.go b/internal/app/tfsec/test/setup_test.go
index d3fe3e6ff..c53dbb60d 100644
--- a/internal/app/tfsec/test/setup_test.go
+++ b/internal/app/tfsec/test/setup_test.go
@@ -49,11 +49,11 @@ resource "problem" "x" {
 		},
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"problem"},
-		DefaultSeverity: severity.Error,
+		DefaultSeverity: severity.High,
 		CheckFunc: func(set result.Set, resourceBlock block.Block, _ *hclcontext.Context) {
 			if resourceBlock.GetAttribute("bad") != nil {
 				set.Add(
-					result.New(resourceBlock).WithDescription("example problem").WithRange(resourceBlock.Range()).WithSeverity(severity.Error),
+					result.New(resourceBlock).WithDescription("example problem").WithRange(resourceBlock.Range()).WithSeverity(severity.High),
 				)
 			}
 		},
diff --git a/internal/app/tfsec/test/wildcard_test.go b/internal/app/tfsec/test/wildcard_test.go
index 66d22cfe1..7711ac556 100644
--- a/internal/app/tfsec/test/wildcard_test.go
+++ b/internal/app/tfsec/test/wildcard_test.go
@@ -62,12 +62,12 @@ func Test_WildcardMatchingOnRequiredLabels(t *testing.T) {
 			Provider:        "custom",
 			RequiredTypes:   []string{"resource"},
 			RequiredLabels:  []string{test.pattern},
-			DefaultSeverity: severity.Error,
+			DefaultSeverity: severity.High,
 			CheckFunc: func(set result.Set, rootBlock block.Block, ctx *hclcontext.Context) {
 				set.Add(
 					result.New(rootBlock).WithDescription(fmt.Sprintf("Custom check failed for resource %s.", rootBlock.FullName())).
 						WithRange(rootBlock.Range()).
-						WithSeverity(severity.Error),
+						WithSeverity(severity.High),
 				)
 			},
 		})