How to Leverage Threat and Attack Intelligence in your…

This article critiques the FAIR risk assessment framework's use of the Threat Capability (TCAP) variable, arguing it is insufficient without considering Attack Complexity and adversary Motivation level. The author recommends integrating threat intelligence and adversary simulation (e.g., penetration testing and attack intelligence) into risk assessments so that likelihood estimates better reflect real-world attacker capabilities and incentives.