What defines a medium likelihood level?

• A. The threat source is motivated and capable, but controls are in place that may impede successful exercise of the vulnerability.
• B. The threat source is not motivated and can't act
• C. The controls are completely ineffective
• D. The vulnerability is not present

Answer: (A)

Likelihood is the probability that a threat will successfully exploit a vulnerability given the existing controls. A medium likelihood occurs when the threat actor is motivated and capable, so there is real potential for exploitation, but the controls in place can impede the attack enough that success isn’t guaranteed. In other words, the situation isn’t unlikely, but it isn’t certain either—the controls reduce the chance to a middle level rather than making it high or negligible. If the threat weren’t motivated or couldn’t act, the likelihood would be low. If the controls were completely ineffective, the likelihood would lean toward high. If the vulnerability weren’t present, the likelihood would be zero.