I am fine with guesstimates for likelihood and severity, but the product doesn't make sense. When two guesstimates are multiplied like that, you choose the terms to give the product you want, or vice versa. The concept of trying to do a distillation of a risk assessment to a number is flawed.

You're right that the product number is not a very meaningful value.

https://en.wikipedia.org/wiki/Risk_matrix

Take a look at this risk matrix. It's divided into cells that are each assigned a category. If you assigned numbers to it, you'd get conflicting results:

1. Possible (3) x Catastrophic (4) = Very High (12)

2. Likely (4) x Critical (3) = High (12)

In this case, 12 can mean either High or Very High. Therefore the category is more important than the product.

So basically, the product is only meaningful if the categories are defined in terms of it, which I don't think is common. Really, I should have said you need the category, rather than the product.