What Does It Truly Need to Be Protected From?—Understanding Threats to Evaluate Risk

This chapter addresses the second core Enterprise Security Risk Management question by identifying the specific threats that could materially impact an organization’s critical assets. It introduces four primary threat categories: intentional, unintentional, environmental and infrastructure, and emerging. It emphasizes the need to link threats to asset context to avoid unfocused mitigation. The chapter explains how intent and capability define threat level, how target attractiveness influences motivation, and how historical data, forward-looking intelligence, and scenario analysis inform probability assessments. It distinguishes vulnerability from general likelihood to highlight the factors security can most directly control and presents a structured model for rating assets, threats, and existing control effectiveness to determine residual risk. By separating these variables, security leaders can clearly communicate risk drivers, prioritize mitigation, and align resource allocation with the threats most relevant to business continuity, compliance, and resilience. They can then apply a structured model that makes those choices visible and actionable for executives.