Likelihood / Impact

About this visualization

Likelihood / Impact is often used in threat modeling to evaluate risk. A widespread formular is Risk = Likelihood * Impact.

This visualization shows Likelihood, Impact ∈ [0, 1] with Risk = √(Likelihood * Impact) and [0, 0.5, 1] mapped to [Green, Yellow, Red]. It can be changed to Risk = (Likelihood + Impact) / 2, where diagonals are assigned same risks.

Various discretization methods are demonstrated:

• 1 - No risk assessment, all-critical bias
• 2 - the most simple triage rating scheme with (Likelihood, Impact) ∈ {LOW, HIGH}² = {1/3, 2/3}²
• 3 - a popular scheme with (Likelihood, Impact) ∈ {LOW, MEDIUM, HIGH}² = {1/4, 2/4, 3/4}²
• 4 5 10 - more granular schemes
• 20 50 100 - turning into a continuum
• 100 - like in the Open Threat Modeling Format (OTM)