What it means
Likelihood answers a specific question over a specific period: how plausible is this harmful event here? A weakness may be severe yet difficult to reach. Another may be easy to exploit on an exposed service that attackers are already targeting. Those conditions change the assessment.
Separate the chance of an attempt from the chance that it succeeds and causes harm. Existing controls, required access, attacker capability, and recent evidence all matter. A label such as “high” is useful only if your organization defines it. A precise-looking percentage without a defensible model does not improve the decision.
AN ILLUSTRATIVE SCENARIO
A school remote-access service
A school learns that attackers are exploiting a weakness in the software used for staff remote access. Its technology team confirms that its own affected version is reachable from the internet. This supports a higher likelihood assessment than the same flaw on a disconnected training machine. The team records the service exposure, vendor advisory, and uncertainty about attempted logins. It recommends a prompt mitigation while checking logs; it does not claim that public exploitation proves the school has been compromised.
Put it to work
- Define the event and time horizon: for example, unauthorized remote access before the scheduled maintenance window next week.
- Collect evidence about reachability, affected versions, exploitation activity, and controls actually operating; distinguish verified facts from assumptions.
- Apply agreed likelihood categories and record the reasoning, confidence, and conditions that would cause you to reassess.
How to check your work
A colleague should be able to trace the likelihood judgment to dated evidence and explain why it differs between the exposed school service and the isolated training machine.
Connect the ideas
- Impact
How badly people or the business are hurt if the loss actually happens.
- Risk
The potential for harm, assessed using what could happen, how likely it is, its impact, and what remains uncertain.
- Exposure
Whether and how a vulnerability or service can actually be reached in this environment.
- Uncertainty
What you still do not know, written explicitly so it is not filled with false precision.