Prioritizing Threats by Impact and Likelihood
Deciding which threats to address first
A complete threat modeling exercise usually produces a list of threats much longer than the team can reasonably mitigate right away, and without a clear prioritization criterion, that list becomes a source of paralysis or, worse, an excuse not to act on any of them. Effective prioritization combines two dimensions: the impact the threat would have if it materialized, considering data loss, service disruption or reputational damage, and the realistic likelihood of it happening, taking into account the sophistication required to exploit it and whether partial controls already exist that make it harder. A threat with catastrophic impact but extremely unlikely to be exploited may justify less immediate investment than one with moderate impact but trivial to carry out, for example an unauthenticated internet-facing endpoint that any opportunistic attacker with basic scanning tools can find in minutes. A nuance that distinguishes mature prioritization is that likelihood isn't static; it changes over time as new automated exploitation tools appear or a known exploit is published, so the prioritized threat list must be reviewed periodically, not fixed once at the end of the initial exercise.