In risk assessment, how is likelihood defined and estimated?

• A. Damage potential of a successful breach
• B. Number of vulnerabilities present in a system
• C. Time to patch a vulnerability
• D. Probability that a threat will exploit a vulnerability; estimated from historical data, threat modeling, and control effectiveness

Answer: (D)

Likelihood in risk assessment is the probability that a threat will exploit a vulnerability, considering what attackers can do and how defenses may stop them. This probability is estimated from historical data on past exploits, threat modeling that maps out realistic attack paths, and evaluations of how effective current controls are at preventing or detecting exploitation. When historical incidents are frequent, attack paths are straightforward, and controls are weak, the likelihood is higher. Strong controls and solid threat modeling lower the chance of successful exploitation. The other options mix up what likelihood measures: damage potential describes impact, not probability; the number of vulnerabilities reflects exposure but not the probability of exploitation; and patch time affects how long a vulnerability is exposed and can influence likelihood indirectly, but is not the probability itself.