organizations? Threat Capability Definition: The means that the attacker has to carry out threats against the organization. Example: This includes, but is not limited to technical skill, financial support, number of staff hours, and legal power. Does the threat actor have the means to exploit a vulnerability that the organization currently has? Does the threat actor have the means to leverage widespread threats against all similar organizations, or will they have to prioritize their targets? Threat Intent Definition: The level of desire for the attacker to carry out threats against the organization. Example: Intent can be goals or outcomes that the adversary seeks; consequences the adversary seeks to avoid; and how strongly the adversary seeks to achieve those outcomes and/or avoid those consequences. Does the threat actor currently have the desire to conduct an attack against this type of organization? Is the organization a priority threat target for the threat actor? Page 9 of 240