Strategic Threat Assessment and Risk Prioritization
Strategic Threat Assessment and Risk Prioritization tests how threat intelligence becomes business risk decisions. Expect threat versus vulnerability versus risk, likelihood and impact, crown-jewel mapping, actor prioritization, scenario analysis, risk registers, and treatment options.
Core rules
- Risk is a function of likelihood and impact. Threat is only one input; vulnerability, exposure, controls, and business consequence also shape risk.
- Anchor assessment in business context: crown jewels, dependencies, safety, regulatory obligations, and operational tolerance. A technically severe threat may be a low business risk if the asset is isolated.
- Prioritize actors by intent, capability, opportunity, and observed targeting, not by report volume or media attention.
- Use scenario-based assessment: describe a plausible event, estimate likelihood and impact with ranges, state assumptions, and identify indicators that would change the estimate.
- Record risks in a register with owner, score, treatment, and review date. Treatment options are avoid, reduce, transfer, and accept, aligned to risk appetite.
- Do not rely on CVSS alone. Consider exploit availability, internet exposure, detection coverage, and business criticality.
Worked example
A hospital compares ransomware and DDoS. Ransomware likelihood is assessed high because the sector is targeted and an internet-facing VPN is exposed; impact is high because of patient safety, downtime, and regulatory exposure. DDoS likelihood is medium, but impact is moderate because redundancy and scrubbing are in place. The risk ranking places ransomware first. Recommended treatment: reduce likelihood through MFA, patching, segmentation, and tested backups; reduce impact through incident exercises. The DDoS risk is accepted with monitoring, not ignored.
Traps that cost marks
- Equating threat with risk. A dangerous actor is not automatically a top business risk.
- Recency bias, prioritizing the latest headline over the most consequential exposure.
- Ignoring business impact and focusing only on technical severity.
- Presenting a single precise score where the evidence supports only a range.
- Leaving risks without an owner or treatment decision.