Risk likelihood is the estimated chance that a threat will take advantage of a vulnerability. It is one of the main inputs in PCI risk analysis and is used alongside potential impact to assign priority. Likelihood should be reassessed as threats, systems, and business conditions change.
How risk likelihood is used
Risk likelihood is the probability side of risk analysis. It helps translate a vulnerability and a plausible threat into a prioritisation decision, so teams can compare issues that may have very different impacts but similar chances of being exploited.
In practice, likelihood is rarely a pure guess. It is usually informed by exploitability, exposure, control strength, attacker interest, and how easy it would be to reach the vulnerable asset. That is why methods such as FIRST EPSS are useful: they frame likelihood as a measurable input to triage rather than a vague intuition.
What changes likelihood over time
Likelihood is not fixed once a risk register entry is written. It can rise or fall as threat activity changes, patches land, business processes shift, dependencies are added, or control coverage improves or degrades.
This is especially important in environments where exploit paths move quickly. A vulnerability that looked low priority last quarter may become more likely if public exploitation appears, a new integration increases exposure, or a compensating control is removed. Likelihood should therefore be treated as a living estimate, not a static label.
For broader control discipline, NIST’s Cybersecurity Framework 2.0 is useful because it ties risk understanding to ongoing governance, identification, protection, detection, response, and recovery activities.
How practitioners estimate it
Most teams estimate likelihood by combining observable factors: known exploitability, internet exposure, privilege required, ease of discovery, attacker motivation, and whether a control failure would be simple or noisy. The goal is consistency, not false precision.
Likelihood becomes more credible when it is grounded in evidence such as exploit data, threat intelligence, control assessments, and architecture review. That is why risk teams often pair likelihood with concrete technical references like NIST SP 800-53 Rev 5 Security and Privacy Controls, which help define the protective measures that can reduce the chance of successful exploitation.
For identity and secret-heavy environments, likelihood is also affected by exposure of credentials and other sensitive access material. NHIMG’s Ultimate Guide to Non-Human Identities shows why long-lived secrets, overprivilege, and weak rotation practices materially change how likely compromise becomes over time.
Why likelihood matters for prioritisation
Likelihood is only one half of risk, but it is the half that often prevents teams from treating every issue as equally urgent. A high-impact issue with very low likelihood may need monitoring and hardening, while a moderate-impact issue with high likelihood may deserve immediate treatment.
The key is calibration. If likelihood is overstated, teams waste effort on low-probability scenarios. If it is understated, they defer real exposure until it becomes an incident. Good prioritisation uses likelihood to guide sequencing, not to excuse inaction.
Where organisations want a more explicit risk-and-reward view of exploitability, EPSS can complement traditional scoring by helping separate theoretically severe issues from issues that are more likely to be exploited in the near term.
Risk and Threat Considerations
Likelihood is where many risk assessments become either useful or misleading. If teams assume a vulnerability is unlikely simply because exploitation has not yet been observed internally, they can miss changing external threat conditions, exposed attack paths, or control weaknesses that make compromise much more probable.
Failure mechanism: Likelihood is underestimated when exposure, exploit maturity, or missing controls are not reassessed as systems, threats, and business dependencies change.
Impact: Underestimated likelihood drives poor prioritisation, delayed remediation, and a larger chance that a reachable weakness becomes a real incident before it is addressed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RM-03 — Risk Prioritization | Risk likelihood is used to rank and prioritise cybersecurity risks. |
| Recommendation — Use GV.RM-03 to rank risks by likelihood and impact, then focus remediation on the most probable exposure. | ||
| CIS Controls v8 | CIS 7 — Continuous Vulnerability Management | Likelihood changes as exploitable weaknesses and exposure conditions evolve. |
| Recommendation — Apply CIS Control 7 to keep vulnerability exposure current and reduce the chance of exploitation. | ||
| NIST SP 800-63 | IAL/AAL/FAL — Identity Assurance Levels / Authenticator Assurance Levels / Federation Assurance Levels | Assurance choices materially affect how likely account compromise or abuse becomes. |
| Recommendation — Set the appropriate assurance level to reduce the likelihood of identity compromise and unauthorized access. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secrets and Credential Management | Secret sprawl and weak rotation materially increase compromise likelihood. |
| NHI-05 — Overprivileged Non-Human Identities | Excessive privilege raises the likelihood that a compromise becomes successful abuse. | |
| NHI-08 — Third-Party and Supply Chain Exposure | External exposure and dependency risk materially change exploitation likelihood. | |
| Recommendation — Rotate and centralize secrets to lower the likelihood of compromise through leaked credentials. Reduce unnecessary privilege to shrink the likelihood that an exposed NHI can be abused. Review third-party access paths to lower the likelihood of compromise through external relationships. | ||
Related resources from NHI Mgmt Group
- Why does Exposure Management help organisations reduce breach likelihood and operational risk?
- Why does weak AI governance increase the likelihood that AI risk controls fail later in the lifecycle?
- Why is DevOps such a significant source of NHI risk?
- What is the biggest long-term risk of unmanaged NHIs multiplying at exponential rates?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
