The chance that a threat exploits a vulnerability and causes harm, usually thought of as likelihood multiplied by impact.