A risk scenario is a short, realistic description of how a loss could happen. It connects the pieces of risk into a story that business managers can understand: a threat (who or what), acting through a vulnerability (how), against an asset (what is affected), with a business consequence (why it matters). 'A criminal group phishes a finance employee, uses the stolen credentials to change a supplier's bank details, and diverts a 250,000 payment' is a scenario. 'Phishing' by itself is not; it is only a threat technique. Scenarios are the bridge between technical findings and business decisions.
Keep reading for free
Create a free StudyToCert account to read the rest of this lesson: 7 more sections, 6 key terms, a real-world example, an exam tip and self-check questions. Every lesson, lab and practice test is free with an account.