The probable frequency, within a given timeframe, that a threat agent will inflict harm upon an asset.
In order for a loss event to occur, a threat agent has to act against an asset, and that action has to result in loss. This leads us to our next two factors: Threat Event Frequency (TEF) and Vulnerability.
Note that time-framing is key to differentiating between possibility and probability because, given enough time, almost any event is possible. By time-framing our analysis, we’re more or less forced to treat the issue as a probability.
Next: Threat Event Frequency
Leave a Reply