Threat Assessment
From threat to risk
Threat assessment is the disciplined conversion of intelligence and history into a judgement about what an adversary might do. Candidates must distinguish threat (a credible actor with intent and capability) from vulnerability (a weakness in the defences) and from risk (the combination of both with consequence). A threat assessment without a stated actor, method and target is just speculation.
Concepts to understand
Know the difference between strategic, tactical and operational threat assessments and who consumes each. Understand indicators and warnings, the role of historical attack databases, and the significance of the improvised explosive device as the dominant historical threat to aviation. Be able to explain why the threat picture changes with geopolitics, technology and insider access, and why a single attack attempt can change screening rules globally within days.
Traps in questions
- Treating a generic "terrorism is a threat" statement as a threat assessment.
- Confusing threat with risk: a high threat against a well-protected target may be low risk.
- Ignoring the insider threat, which bypasses perimeter controls entirely.
- Assuming the threat is static and that past methods predict future ones exactly.
Rule of thumb
Use the three-part test: who (actor with intent and capability), how (method and means), and where (target and pathway). If any of the three is missing, the assessment is incomplete. Example: "a group with demonstrated IED capability (who) seeking to place a device in cabin baggage (how) on an international departure (where)" is an assessment; "bomb threat is high" is not.