Threat and Risk Assessment
Threat, vulnerability, risk
Threat and risk assessment is the analytical foundation of every protective task. Candidates must separate three concepts: threat (a credible actor or hazard with intent and capability), vulnerability (a gap in protection that a threat can exploit), and risk (the product of likelihood and impact, moderated by vulnerability). A common exam trap is treating a high-profile client as automatically high-risk; risk is situational and must be reassessed as the environment, itinerary, and intelligence change.
Understand the assessment cycle: identify assets and principals, gather threat intelligence, map vulnerabilities across people, information, and physical layers, assign likelihood and impact ratings, and record mitigation decisions. Distinguish strategic (long-range, actor-level) from tactical (event-specific) assessment. Note the difference between inherent risk before controls and residual risk after them; questions often ask which figure should drive the protective plan - the answer is residual risk, with any residual above tolerance escalated to the client.
Traps and rule of thumb
Watch for questions that conflate a threat assessment (who might attack and why) with a risk assessment (how likely and how damaging). Also beware of treating a single-source tip as established fact; intelligence must be graded for source reliability and information credibility.
Worked rule of thumb: rate likelihood 1–5 and impact 1–5, multiply, then subtract the effect of controls. A credible lone actor (likelihood 3) against a principal with no close protection (impact 5) gives inherent risk 15; layered controls that cut likelihood to 1 leave residual risk 5, which may sit within tolerance.