{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/likelihood","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/likelihood/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/likelihood/"},"term":{"en":"Likelihood","da":"Sandsynlighed"},"aka":{"en":["probability"],"da":[]},"domain":["security"],"cluster":"fundamentals","layer":"governance","status":"current","summary":{"en":"How probable it is that a given threat will actually use a weakness and cause harm within a certain period.","da":"Hvor sandsynligt det er, at en given trussel faktisk udnytter en svaghed og gør skade inden for en bestemt periode."},"body":{"formal":{"en":"An estimate of how often, or how probably, a threat will exploit a vulnerability, rated from rare to almost certain and combined with impact to score a risk. It draws on past events, known attacks and existing controls.","da":"Et skøn over, hvor ofte eller hvor sandsynligt en trussel udnytter en sårbarhed, vurderet fra sjælden til næsten sikker og kombineret med konsekvens til en risikoscore. Skønnet bygger på tidligere hændelser, kendte angreb og eksisterende kontroller."},"plain":{"en":"Like a pot on the stove - if you walk away it will almost surely boil over; if you stand and watch, it hardly ever does.","da":"Som en gryde på komfuret - går du fra den, koger den næsten sikkert over; står du og holder øje, sker det næsten aldrig."},"inPractice":{"en":"The IT security team in a Danish region rates phishing mails as almost certain to arrive every month, but flooding of its top-floor server room as rare.","da":"IT-sikkerhedsteamet i en region vurderer, at phishingmails næsten sikkert kommer hver måned, mens en oversvømmelse af serverrummet på øverste etage er sjælden."},"whyItMatters":{"en":"Without a sense of how probable each threat is, an organisation spends as much on unlikely events as on the ones that happen every week.","da":"Uden en fornemmelse af, hvor sandsynlig hver trussel er, bruger man lige så meget på usandsynlige hændelser som på dem, der sker hver uge."}},"deepDive":{"en":"In formal risk assessment, likelihood is not a single number but a composite. NIST SP 800-30 Rev. 1 splits it into the likelihood of threat-event initiation or occurrence and the likelihood that, once initiated, the event results in adverse impact; the overall likelihood is the combination of the two. This matters because a common threat that meets strong controls can have high initiation likelihood but low likelihood of impact, and multiplying the wrong pair overstates risk. NIST expresses each on a five-level qualitative scale (Very Low to Very High) mapped to semi-quantitative bands (roughly 0-4, 5-20, 21-79, 80-95, 96-100 on a 0-100 scale) so that assessors reason consistently without implying spurious precision.\n\nISO/IEC 27005, the information-security companion to ISO 31000, uses likelihood the same way but leaves the scale to the organisation, which is why two firms' \"medium\" are rarely comparable. The deeper distinction is between frequency and probability: for recurring events (phishing emails, port scans) likelihood is naturally a rate per period, whereas for one-off events (a specific zero-day being weaponised) it is a probability over a horizon. Conflating them produces the classic error of scoring a \"once in ten years\" flood on the same axis as \"arrives every week\", which the risk criteria set during the context phase are meant to prevent by defining what each level means in words and, ideally, in numbers.\n\nQuantitative approaches replace the ordinal scale with distributions. The FAIR model, for instance, decomposes likelihood into threat event frequency and vulnerability (the probability a threat event becomes a loss event), then runs a Monte Carlo simulation to produce a loss-exceedance curve rather than a single point. This exposes tail risk that a five-by-five matrix hides, but it demands defensible input data - historical incident rates, threat-intelligence base rates, control-efficacy estimates - that many organisations lack, so most start qualitative and quantify only the few decisions where a large investment turns on the number.\n\nTwo persistent misconceptions distort likelihood estimates. The first is treating the ordinal labels as if they were arithmetic: multiplying a likelihood \"3\" by an impact \"4\" to get \"12\" is not a real product, because the underlying scale is not linear or even interval. The second is ignoring that likelihood is conditional on the current control set and therefore changes the moment a control is added, removed or degrades - a risk register that is not re-scored after treatment records a probability that no longer exists. Sound practice states the assumptions, the time horizon and the control baseline behind every likelihood value, so the same event can be re-evaluated consistently as conditions change.","da":"I formel risikovurdering er sandsynlighed ikke ét tal, men en sammensat størrelse. NIST SP 800-30 Rev. 1 opdeler den i sandsynligheden for, at en trusselshændelse indledes eller opstår, og sandsynligheden for, at hændelsen - når den først er indledt - fører til en negativ konsekvens; den samlede sandsynlighed er kombinationen af de to. Det er vigtigt, fordi en almindelig trussel, der møder stærke kontroller, kan have høj sandsynlighed for at blive indledt, men lav sandsynlighed for konsekvens, og at gange de forkerte to sammen overvurderer risikoen. NIST udtrykker hver på en femtrins kvalitativ skala (meget lav til meget høj), knyttet til semikvantitative bånd (groft 0-4, 5-20, 21-79, 80-95, 96-100 på en 0-100-skala), så vurderingerne bliver konsistente uden at foregøgle en falsk præcision.\n\nISO/IEC 27005, informationssikkerhedens modstykke til ISO 31000, bruger sandsynlighed på samme måde, men overlader skalaen til organisationen, og derfor er to virksomheders \"middel\" sjældent sammenlignelige. Den dybere skelnen er mellem hyppighed og sandsynlighed: for tilbagevendende hændelser (phishingmails, portscanninger) er sandsynlighed naturligt en rate pr. periode, mens den for engangshændelser (at en bestemt zero-day bliver udnyttet i praksis) er en sandsynlighed over en tidshorisont. At blande dem sammen giver den klassiske fejl at score en \"en gang hvert tiende år\"-oversvømmelse på samme akse som \"kommer hver uge\" - hvilket de risikokriterier, der fastlægges i kontekstfasen, netop skal forhindre ved at definere, hvad hvert niveau betyder i ord og helst i tal.\n\nKvantitative tilgange erstatter den ordinale skala med fordelinger. FAIR-modellen dekomponerer fx sandsynlighed i threat event frequency og vulnerability (sandsynligheden for, at en trusselshændelse bliver til en tabshændelse) og kører derefter en Monte Carlo-simulering, der giver en tabsoverskridelseskurve frem for ét punkt. Det synliggør halerisiko, som en fem-gange-fem-matrix skjuler, men det kræver forsvarlige inputdata - historiske hændelsesrater, base rates fra trusselsefterretning, skøn over kontrollers effektivitet - som mange organisationer mangler, så de fleste starter kvalitativt og kvantificerer kun de få beslutninger, hvor en stor investering afhænger af tallet.\n\nTo vedholdende misforståelser forvrider sandsynlighedsskøn. Den første er at behandle de ordinale niveauer, som om de var aritmetik: at gange en sandsynlighed \"3\" med en konsekvens \"4\" og få \"12\" er ikke et rigtigt produkt, for den underliggende skala er hverken lineær eller på intervalniveau. Den anden er at overse, at sandsynlighed er betinget af det aktuelle sæt kontroller og derfor ændrer sig i det øjeblik, en kontrol tilføjes, fjernes eller forringes - et risikoregister, der ikke scores på ny efter behandling, registrerer en sandsynlighed, der ikke længere findes. God praksis angiver antagelserne, tidshorisonten og kontrolgrundlaget bag hver sandsynlighedsværdi, så den samme hændelse kan vurderes konsistent igen, når forholdene ændrer sig."},"edges":[{"type":"requires","to":"security/threat","confidence":"high","strength":"normal"},{"type":"requires","to":"security/vulnerability","confidence":"high","strength":"normal"},{"type":"part-of","to":"security/risk","why":{"en":"Risk is how likely an event is weighed against how much harm it would do.","da":"Risiko er, hvor sandsynlig en hændelse er, vejet op mod hvor stor skade den vil gøre."},"confidence":"high","strength":"primary"}],"depth":2,"sources":[{"title":"Cyber Security Fast Track - Ordliste (Risiko)","tier":"course-material"},{"title":"ISO/IEC 27005 - Information security risk management","tier":"standard","publisher":"ISO"},{"title":"NIST SP 800-30 Rev. 1 - Guide for Conducting Risk Assessments","url":"https://csrc.nist.gov/pubs/sp/800/30/r1/final","tier":"standard","publisher":"NIST"}],"draft":true}