Threat risk assessments against technology-based systems and
surrounding environments are increasingly mandated by customers and
regulators. Threat risk assessments (TRAs) are typically done
either pre-breach event as internal due diligence, or responsive to
an event to determine the origins of the event and the scope of the
impact. The breadth and penetration level of TRAs vary, but they
are inherently intrusive, command significant time and financial
resources, and will inevitably result in disclosing areas of
possible vulnerabilities.
The intent of TRAs is in part to identify those weaknesses, but
that goal is often balanced by the concern that having actual
knowledge of weaknesses and vulnerabilities exposes businesses to
greater liability upon a breach event if the business was unable to
implement a solution before the breach event occurs. Rectifying
vulnerabilities, which could include simply catching up on
ever-changing industry standards, often takes a
