What it means
Likelihood answers a specific question over a specific period: how plausible is this harmful event here? A weakness may be severe yet difficult to reach. Another may be easy to exploit on an exposed service that attackers are already targeting. Those conditions change the assessment.
Separate the chance of an attempt from the chance that it succeeds and causes harm. Existing controls, required access, attacker capability, and recent evidence all matter. A label such as “high” is useful only if your organization defines it. A precise-looking percentage without a defensible model does not improve the decision.
The idea at a glance / Risk
A working path is not a probability.
One export test shows what a valid session can obtain. It does not measure how often that session will be stolen.
Fictional MetroMart R61, 25 September 2026 at 09:00 UTC, with the original permission. Assess Store B disclosure through SV-4 before 2 October, 09:00 UTC.
READ THE PICTURE
Read the evidence and limits
T61 demonstrates the path if equivalent SV-4 access is stolen. The chance of theft during the seven-day window is unknown. A working path supports assessment; it does not supply a probability.
Keep in mindA single test is not a measured event rate. This example does not assign a likelihood category or percentage, and it does not confirm a compromise.
Read the complete example
- Read the evidence and limits. T61 demonstrates the path if equivalent SV-4 access is stolen. The chance of theft during the seven-day window is unknown. A working path supports assessment; it does not supply a probability. At the 09:00 UTC snapshot on 25 September 2026, the harmful event under assessment is unauthorized disclosure of Store B reconciliation records via SV-4’s session before 09:00 UTC on 2 October. First consider initiation: whether an attacker will obtain and misuse a valid SV-4 session in that window. No theft-rate study or relevant local session-theft investigation is supplied, so its probability is not measured here. Second consider harm conditional on that event: the export API is reachable by the ordinary client, its current permission includes all stores, and controlled test T61 at 08:45 returned synthetic Store B records to SV-4. The tester had a legitimate session; the exercise demonstrates what that session could obtain, not that someone stole it. The test supports a credible disclosure path if an attacker gets equivalent valid access under the same conditions. It does not establish how often such access will be obtained, guarantee every attempted export will work, or measure the extent of harm. Morgan’s proposed store-scoped restriction is unfinished at this snapshot and cannot reduce the current assessment. Future assessment needs dated evidence about targeting, session exposure, operating controls, and changes to this API. Severity of a weakness is also not the local probability of this event. A defined organizational method could turn fuller evidence into a rating; this figure deliberately stops at the supported conditional path and unresolved occurrence likelihood.
A single test is not a measured event rate. This example does not assign a likelihood category or percentage, and it does not confirm a compromise.
Diagram references: NIST SP 800-30 Rev. 1 - risk factors, assumptions and assessment limits
AN ILLUSTRATIVE SCENARIO
A school remote-access service
A school learns that attackers are exploiting a weakness in the software used for staff remote access. Its technology team confirms that its own affected version is reachable from the internet. This supports a higher likelihood assessment than the same flaw on a disconnected training machine. The team records the service exposure, vendor advisory, and uncertainty about attempted logins. It recommends a prompt mitigation while checking logs; it does not claim that public exploitation proves the school has been compromised.
Put it to work
- Define the event and time horizon: for example, unauthorized remote access before the scheduled maintenance window next week.
- Collect evidence about reachability, affected versions, exploitation activity, and controls actually operating; distinguish verified facts from assumptions.
- Apply agreed likelihood categories and record the reasoning, confidence, and conditions that would cause you to reassess.
How to check your work
A colleague should be able to trace the likelihood judgment to dated evidence and explain why it differs between the exposed school service and the isolated training machine.
Connect the ideas
- Impact
How badly people or the business are hurt if the loss actually happens.
- Risk
The potential for harm, assessed using what could happen, how likely it is, its impact, and what remains uncertain.
- Exposure
Whether and how a vulnerability or service can actually be reached in this environment.
- Uncertainty
What you still do not know, written explicitly so it is not filled with false precision.