What defines a high likelihood level?

• A. The threat source is highly motivated and sufficiently capable, and controls to prevent the vulnerability from being exercised are ineffective.
• B. The threat source is moderately motivated and capable, with some controls
• C. The threat source is not motivated
• D. The vulnerability is not present

Answer: (A)

High likelihood means there is a strong chance that a threat will successfully exploit a vulnerability. This happens when the threat source is highly motivated and sufficiently capable, and the defenses or controls in place are ineffective at preventing the exploit. In other words, a driven attacker who can do the job plus weak or absent safeguards creates conditions where exploitation is very probable.

If motivation and capability are only moderate, or if some controls exist that can block the attack, the likelihood would be lower. If the threat isn’t motivated at all, or the vulnerability isn’t present, the likelihood would be very low or zero.