Likelihood

In formal risk assessment, likelihood is not a single number but a composite. NIST SP 800-30 Rev. 1 splits it into the likelihood of threat-event initiation or occurrence and the likelihood that, once initiated, the event results in adverse impact; the overall likelihood is the combination of the two. This matters because a common threat that meets strong controls can have high initiation likelihood but low likelihood of impact, and multiplying the wrong pair overstates risk. NIST expresses each on a five-level qualitative scale (Very Low to Very High) mapped to semi-quantitative bands (roughly 0-4, 5-20, 21-79, 80-95, 96-100 on a 0-100 scale) so that assessors reason consistently without implying spurious precision.

ISO/IEC 27005, the information-security companion to ISO 31000, uses likelihood the same way but leaves the scale to the organisation, which is why two firms' "medium" are rarely comparable. The deeper distinction is between frequency and probability: for recurring events (phishing emails, port scans) likelihood is naturally a rate per period, whereas for one-off events (a specific zero-day being weaponised) it is a probability over a horizon. Conflating them produces the classic error of scoring a "once in ten years" flood on the same axis as "arrives every week", which the risk criteria set during the context phase are meant to prevent by defining what each level means in words and, ideally, in numbers.

Quantitative approaches replace the ordinal scale with distributions. The FAIR model, for instance, decomposes likelihood into threat event frequency and vulnerability (the probability a threat event becomes a loss event), then runs a Monte Carlo simulation to produce a loss-exceedance curve rather than a single point. This exposes tail risk that a five-by-five matrix hides, but it demands defensible input data - historical incident rates, threat-intelligence base rates, control-efficacy estimates - that many organisations lack, so most start qualitative and quantify only the few decisions where a large investment turns on the number.

Two persistent misconceptions distort likelihood estimates. The first is treating the ordinal labels as if they were arithmetic: multiplying a likelihood "3" by an impact "4" to get "12" is not a real product, because the underlying scale is not linear or even interval. The second is ignoring that likelihood is conditional on the current control set and therefore changes the moment a control is added, removed or degrades - a risk register that is not re-scored after treatment records a probability that no longer exists. Sound practice states the assumptions, the time horizon and the control baseline behind every likelihood value, so the same event can be re-evaluated consistently as conditions change.