How CSPM Solutions Calculate Risk Score

I kept getting asked by my team why one misconfiguration shows up as CRITICAL while another similar one is just LOW. After digging into how Orca, Wiz, and AWS Security Hub actually calculate their scores, I realized most of us don't really understand...