Likelihood estimates how likely a threat is to occur. In a risk assessment, it helps turn identified threats and vulnerabilities into decisions about which controls to prioritize. In a predictive threat index, threat likelihood reflects how frequently a threat or attack vector appears in threat intelligence feeds. section 6.3 section 10.2.2
Check the estimate against the organization’s environment:
- Consider the threat, relevant vulnerabilities, and whether an exploit has been published. EPSS can help estimate exploitation in the wild. section 6.3.1
- Treat CVSS severity as a guide, not a direct measure of local likelihood: compensating controls and layered security can change exposure. section 6.3.1
Prioritizing malware defenses
Suppose an organization recorded 15 malware attacks in a year, threat intelligence indicates a 30% malware likelihood, and it manages 200 critical assets. Its illustrative predictive threat index is (15 × 0.30) ÷ 200 = 0.0225, or 2.25%. Use that signal to prioritize detection and protection on vulnerable assets, then check whether local controls alter the risk. section 10.2.2 section 6.3.1
Likelihood can also describe outcomes within a time period. A bar chart of possible monthly exploit counts might show three exploits as most likely, helping the security team plan capacity around that scenario rather than a raw total alone. section 11.9.1
