Overview
Likelihood is the "how probable is it?" half of risk. Estimating likelihood well is what keeps a risk assessment grounded — otherwise every scary-sounding scenario looks equally urgent. This lesson explains what shapes likelihood and how teams estimate it.
Learning objectives
- Define likelihood in a risk context.
- Identify the factors that raise or lower it.
- Understand qualitative vs. quantitative likelihood estimates.
Core concept
Likelihood is the probability that a given threat successfully exploits a vulnerability within a defined period. It rises and falls with several factors:
- Threat activity — are attackers actively targeting this kind of system? Is there a working, public exploit?
- Exposure — is the asset reachable from the internet, or isolated internally?
- Vulnerability severity and ease of use — how easy is the weakness to exploit?
- Existing controls — do current defenses reduce the chance of success?
How it works
Likelihood can be expressed two ways:
- Qualitative — descriptive bands like Rare / Unlikely / Possible / Likely / Almost Certain. Fast, intuitive, and most common in practice.
- Quantitative — an actual probability or frequency (e.g. "roughly once every 3 years"). More precise but needs data that is often unavailable in security.
Most organizations use qualitative bands, sometimes informed by whatever data they have (past incidents, threat intelligence, exploitation trends).
Practical example
Two vulnerabilities have the same technical severity. Vulnerability A is on an internet-facing server, has a public exploit, and attackers are actively scanning for it — likelihood: Almost Certain. Vulnerability B is identical but sits on an isolated internal system with no known exploit and strict access controls — likelihood: Unlikely. Same severity, very different likelihood, so A is fixed first.
Cybersecurity relevance
Threat intelligence exists largely to sharpen likelihood estimates: knowing which flaws are being exploited "in the wild" tells you which are likely, not just possible. This is why "exploited in the wild" advisories trigger urgent patching.
Common mistakes
- Confusing possible with likely. Almost anything is possible; risk work is about what is probable.
- Ignoring exposure and existing controls, which strongly shape likelihood.
- Demanding precise probabilities where no data exists, instead of using sensible qualitative bands.
Key takeaways
- Likelihood is the probability a threat exploits a vulnerability in a given timeframe.
- It depends on threat activity, exposure, ease of exploitation, and existing controls.
- Qualitative bands are the common, practical way to express it.
Check your understanding
- Two servers share the same flaw; one is public, one is isolated. Why do their likelihoods differ?
- Why does an "actively exploited in the wild" notice raise likelihood so sharply?