Threat Assessment Methodology
A threat assessment evaluates the threat posed by a specific actor or scenario to a specific target. It combines Intent, Capability, and Opportunity into an overall Threat Level.
Formula
Threat = Intent + Capability + Opportunity
All three must be present for a credible threat. A highly capable actor with no intent poses minimal threat. A motivated actor with no capability poses minimal threat.
Assessment Components
Intent — What does the adversary want?
| Rating |
Criteria |
| Demonstrated |
Active targeting observed, stated objectives, ongoing operations against similar targets |
| Probable |
Historical targeting of similar organisations/sectors, geopolitical alignment, inferred from capability development |
| Possible |
General capability exists, sector/geography falls within known interests, no direct indicators |
| Unlikely |
No known interest in sector/geography, no historical targeting of similar targets |
Evidence to assess intent:
- Direct targeting of the organisation or sector
- Stated objectives (manifestos, claims, leaked documents)
- Historical targeting patterns
- Geopolitical/economic motivations
- Reconnaissance activity observed
Capability — What can the adversary do?
| Rating |
Criteria |
| Advanced |
Zero-day exploitation, custom tooling, state-level resources, proven track record of complex operations |
| Significant |
Sophisticated TTPs, modified tools, professional operations, ability to adapt |
| Moderate |
Known exploits and commodity tools, some custom capability, competent operations |
| Basic |
Script-kiddie level, publicly available tools only, limited operational security |
Evidence to assess capability:
- Known tools and malware sophistication
- Historical operations and their complexity
- Resources (financial, human, infrastructure)
- Ability to develop or acquire zero-days
- Operational security and counter-intelligence capability
Opportunity — What attack surface exists?
| Rating |
Criteria |
| Significant |
Large internet-facing footprint, known unpatched vulnerabilities, supply chain exposure, limited security controls |
| Moderate |
Some internet exposure, generally patched but gaps exist, reasonable security controls |
| Limited |
Minimal attack surface, strong security controls, rapid patching, limited supply chain exposure |
| Minimal |
Air-gapped or highly restricted, advanced security controls, comprehensive monitoring |
Evidence to assess opportunity:
- Internet-facing services and known vulnerabilities
- Supply chain relationships and third-party access
- Security control maturity (detection, response)
- Employee exposure (social media, conferences)
- Historical incidents and near-misses
Combining into Threat Level
| Level |
Criteria |
| CRITICAL |
Demonstrated intent + Advanced capability + Significant opportunity. Attack is imminent or ongoing. |
| HIGH |
Strong intent indicators + Significant capability + Exploitable opportunity. Attack is highly likely. |
| MODERATE |
Some intent indicators + Moderate capability + Some opportunity. Attack is a realistic possibility. |
| LOW |
Limited intent indicators + Basic/Moderate capability + Limited opportunity. Attack is unlikely. |
| NEGLIGIBLE |
No credible intent OR minimal capability OR no meaningful opportunity. |
Output Template
## Threat Assessment: [Subject]
**Date**: YYYY-MM-DD | **Confidence**: [Level] | **TLP**: [Level]
### Threat Level: [CRITICAL/HIGH/MODERATE/LOW/NEGLIGIBLE]
### Intent: [Rating]
[Assessment with evidence and confidence]
### Capability: [Rating]
[Assessment with evidence and confidence]
### Opportunity: [Rating]
[Assessment with evidence and confidence]
### Combined Assessment
[Synthesis of intent + capability + opportunity into overall threat level. Use likelihood language for forward-looking statements.]
### Key Assumptions
[Per key-assumptions-check]
### Recommended Mitigations
1. [Prioritised by impact on reducing threat level]
### Sources
[With Admiralty Scale ratings]
1---2name: threat-assessment3description: Structured threat assessment methodology. Intent + Capability + Opportunity = Threat Level. Use when formally evaluating a threat.4---56# Threat Assessment Methodology78A threat assessment evaluates the threat posed by a specific actor or scenario to a specific target. It combines Intent, Capability, and Opportunity into an overall Threat Level.910## Formula11**Threat = Intent + Capability + Opportunity**1213All three must be present for a credible threat. A highly capable actor with no intent poses minimal threat. A motivated actor with no capability poses minimal threat.1415## Assessment Components1617### Intent — What does the adversary want?18| Rating | Criteria |19|--------|---------|20| **Demonstrated** | Active targeting observed, stated objectives, ongoing operations against similar targets |21| **Probable** | Historical targeting of similar organisations/sectors, geopolitical alignment, inferred from capability development |22| **Possible** | General capability exists, sector/geography falls within known interests, no direct indicators |23| **Unlikely** | No known interest in sector/geography, no historical targeting of similar targets |2425**Evidence to assess intent:**26- Direct targeting of the organisation or sector27- Stated objectives (manifestos, claims, leaked documents)28- Historical targeting patterns29- Geopolitical/economic motivations30- Reconnaissance activity observed3132### Capability — What can the adversary do?33| Rating | Criteria |34|--------|---------|35| **Advanced** | Zero-day exploitation, custom tooling, state-level resources, proven track record of complex operations |36| **Significant** | Sophisticated TTPs, modified tools, professional operations, ability to adapt |37| **Moderate** | Known exploits and commodity tools, some custom capability, competent operations |38| **Basic** | Script-kiddie level, publicly available tools only, limited operational security |3940**Evidence to assess capability:**41- Known tools and malware sophistication42- Historical operations and their complexity43- Resources (financial, human, infrastructure)44- Ability to develop or acquire zero-days45- Operational security and counter-intelligence capability4647### Opportunity — What attack surface exists?48| Rating | Criteria |49|--------|---------|50| **Significant** | Large internet-facing footprint, known unpatched vulnerabilities, supply chain exposure, limited security controls |51| **Moderate** | Some internet exposure, generally patched but gaps exist, reasonable security controls |52| **Limited** | Minimal attack surface, strong security controls, rapid patching, limited supply chain exposure |53| **Minimal** | Air-gapped or highly restricted, advanced security controls, comprehensive monitoring |5455**Evidence to assess opportunity:**56- Internet-facing services and known vulnerabilities57- Supply chain relationships and third-party access58- Security control maturity (detection, response)59- Employee exposure (social media, conferences)60- Historical incidents and near-misses6162## Combining into Threat Level6364| Level | Criteria |65|-------|---------|66| **CRITICAL** | Demonstrated intent + Advanced capability + Significant opportunity. Attack is imminent or ongoing. |67| **HIGH** | Strong intent indicators + Significant capability + Exploitable opportunity. Attack is highly likely. |68| **MODERATE** | Some intent indicators + Moderate capability + Some opportunity. Attack is a realistic possibility. |69| **LOW** | Limited intent indicators + Basic/Moderate capability + Limited opportunity. Attack is unlikely. |70| **NEGLIGIBLE** | No credible intent OR minimal capability OR no meaningful opportunity. |7172## Output Template7374```markdown75## Threat Assessment: [Subject]76**Date**: YYYY-MM-DD | **Confidence**: [Level] | **TLP**: [Level]7778### Threat Level: [CRITICAL/HIGH/MODERATE/LOW/NEGLIGIBLE]7980### Intent: [Rating]81[Assessment with evidence and confidence]8283### Capability: [Rating]84[Assessment with evidence and confidence]8586### Opportunity: [Rating]87[Assessment with evidence and confidence]8889### Combined Assessment90[Synthesis of intent + capability + opportunity into overall threat level. Use likelihood language for forward-looking statements.]9192### Key Assumptions93[Per key-assumptions-check]9495### Recommended Mitigations961. [Prioritised by impact on reducing threat level]9798### Sources99[With Admiralty Scale ratings]100```
Liberty91LTD