How does likelihood of occurrence work in risk assessment?

What likelihood of occurrence is actually measuring

Likelihood of occurrence is not a guarantee, and it is not just a gut feel about whether something seems “likely.” It is a judgement about the chance of a threat event occurring in a defined scope, with a defined timeframe and assumptions. That means the same event can score differently depending on environment, exposure, attacker interest, and how well controls are working.

Because it is an estimate, the quality of the rating depends on the quality of the evidence behind it. Good assessments distinguish between historical frequency, present exposure, and current control strength rather than collapsing all three into one number. That is why the same method can produce different results for the same threat across different systems or business units.

The practical value of likelihood is that it lets teams compare risks consistently enough to decide what to treat first. A well-formed likelihood score does not replace impact, it sits beside impact so that teams can prioritise based on both probability and consequence. A useful comparison is the one a risk register makes between likelihood and impact scoring, where assumptions, owners, and review cadence are part of the control process, not an afterthought.

What evidence should influence the rating

Likelihood should be anchored in observable conditions. Exposure matters because systems that are externally reachable, broadly permissioned, or widely integrated tend to face more opportunities for a threat event. Threat activity matters because an asset that is actively being probed, targeted, or scanned has a higher expected chance of being hit than one with the same theoretical vulnerability but no observable interest.

Control strength also matters, but only when it is real and current. A control that exists on paper but is not enforced should not reduce likelihood much, and a control that only partially covers the relevant path should reduce it only modestly. The same logic is why practitioners often pair the score with a structured treatment workflow, as in the Cyber Risk Quantification Guide, which frames estimates in terms of evidence, uncertainty, and measurable assumptions.

Timeframe is equally important. A one-year likelihood can be very different from a 30-day likelihood, especially where change is rapid or where threat activity is seasonal, campaign-driven, or tied to a known event. If the timeframe is vague, the score is usually too vague to support a defensible treatment decision.

How to use likelihood without overtrusting the number

Likelihood is most useful when it is treated as a decision support input, not as a precise forecast. In practice, many teams benefit from using bands such as low, medium, and high, or from defining what evidence would move a rating up or down. That keeps the conversation on risk drivers instead of false precision.

For more mature programmes, likelihood should be reviewed whenever the environment changes materially: new exposure, new attacker interest, control degradation, or a new dependency. That is why many assessments are tied to recurring review rather than one-time classification, especially in programme-level methods such as the AI Risk Assessment Guide, which explicitly treats reassessment as part of the workflow rather than a final step.

Where teams struggle is not usually the maths, but the judgement. If the estimate is based only on opinion, it can drift toward optimism or pessimism without anyone noticing. The better practice is to record why the likelihood was set at that level, what changed the last time it was reviewed, and what evidence would justify a re-rating.

Risk and Threat Considerations

Likelihood becomes misleading when it is disconnected from real exposure or from active threat behaviour. A low score can create false reassurance, while a high score can become so generic that it stops driving action. The main risk is not the label itself, but the quality of the assumptions underneath it.

Failure mechanism: Teams overrate or underrate occurrence because they use static templates, outdated threat data, or untested assumptions about control effectiveness. If the rating is not revised when conditions change, it can become a stale input that no longer reflects current exposure or adversary pressure.

Impact: Misstated likelihood distorts prioritisation, which can send resources to the wrong risks, delay treatment of material exposures, or create unjustified acceptance of a risk that is already active. Over time, it also weakens trust in the risk register itself.

Practitioner Guidance

What to verify: Check whether the scoring method distinguishes exposure, threat activity, and control strength, rather than blending them into one subjective impression. If those drivers are not separately visible, the rating is usually too weak to defend.

Decision rule: If the environment or threat landscape has changed since the last review, recalculate likelihood instead of carrying forward the old score. If no meaningful change has occurred, preserve the rating but document why the assumption still holds.

What practitioners underestimate: The hardest part is usually consistency across assessors. Two analysts can agree on the same impact but assign very different likelihoods unless the team has clear evidence standards and a shared review cadence.

Practitioner takeaway: Likelihood of occurrence is only useful when it is evidence-based, time-bound, and revisited as conditions change, otherwise it becomes a polished estimate that hides uncertainty instead of managing it.

Related resources from NHI Mgmt Group

• Why do non-human identities create more audit risk than human accounts?
• Why do non-human identities create audit risk in modern environments?
• Why do non-human identities create compliance risk even when policies exist?
• Why do collaboration tools create such a large secrets risk?