Two findings reach a security manager on the same morning. One lets anyone on the internet deface the company's public blog. The other would expose every employee's bank details, but only to an attacker who is already inside the HR network. Deciding which matters more comes down to two questions that run through every security decision: how likely is it to happen, and how bad would it be?
On the CompTIA Security+ SY0-801 exam, likelihood, impact and the threat life cycle sit under objective 2.1, which expects you to judge threats by more than their names. This lesson covers how likelihood and impact combine into risk, what drives each, which controls lower which, and the two things people mean by "threat life cycle": the intelligence process that produces threat information, and the way a threat itself rises and fades. The formulas for quantitative risk, such as annualized loss expectancy, are in the risk management section.
Risk is where likelihood and impact meet
A threat is any actor or event with the potential to cause harm: a ransomware crew, a careless administrator, a flood. A vulnerability is a weakness a threat can exploit. Risk is the chance that a threat exploits a vulnerability, weighed by the harm that follows. Two terms carry that weighing. Likelihood is how probable it is that the threat event happens and succeeds within some period. Impact is how much damage it does if it does.
At a concept level, risk rises with both: risk is roughly likelihood multiplied by impact. Many organizations rate each on a 1–5 scale and plot the result on a heat map, so a likely but minor event (4 × 2 = 8) and an unlikely but severe one (2 × 5 = 10) land in similar territory for different reasons.
| Scenario | Likelihood | Impact | Overall risk |
|---|---|---|---|
| Mass phishing against staff who have MFA and a mail filter | High | Low | Medium |
| Ransomware through an unpatched internet-facing VPN | High | High | High |
| Flood at a data center far from any flood zone | Low | High | Medium |
Neither factor alone sets priority. A threat with no vulnerability to exploit carries little risk, and so does a vulnerability no threat can reach. In the opening example, the blog defacement is likely but low impact, while the payroll exposure is less likely but severe. Which wins depends on how exposed the HR network really is, which is why both factors must be estimated honestly.
Likelihood depends on who wants in, how easy it is and how exposed you are
Likelihood is mostly about the threat side and your exposure to it. These factors move it:
- Intent and capability: is anyone motivated to attack this, and can they? A defense contractor faces state-sponsored groups; a small retailer mostly faces opportunistic criminals running automated tools.
- Exploitability: is there public exploit code, does the attack need credentials or a user's click, and can it be automated at scale?
- Exposure: internet-facing services are probed by automated scanners within minutes to hours of going live, while a system on an isolated network needs an attacker to get inside first.
- Existing controls: MFA, patching, segmentation and EDR all make success less likely.
- History and intelligence: has this happened to you or your sector before, and do current advisories say it is happening now?
Threat intelligence feeds mostly into this side. A CISA advisory saying a group is exploiting a flaw in the VPN your sector relies on raises likelihood sharply overnight, even though nothing about your network changed.
Likelihood can be expressed qualitatively (rare, unlikely, possible, likely, almost certain) or as a frequency, such as expected occurrences per year; the second form drives the calculations in the risk management section. On the exam, phrases such as "actively exploited," "public exploit code," "internet-facing" and "no authentication required" raise likelihood, while "isolated network," "requires physical access" and "no known exploit" lower it.