1. Home
2. Help
3. Using RiskTree
4. Threat values

There are two categories of threat values used in RiskTree. The standard one uses terms from the IS1&2 risk assessment approach, whilst the alternative uses the PHIA Yardstick, as defined in the Professional Head of Intelligence Assessment Professional Development Framework. The standard method refers to capability and motivation; PHIA uses the terms capability and intent. These are almost synonymous, with capability defining the relevant skills and experience that an attacker has in order to perpetrate the attack, whilst motivation/intent sets out how much they are inclined to perform the attack.

Standard approach

Both capability and motivation are defined on the following scale:

Capability / Motivation	Very low	Low	Medium	High	Very high

PHIA approach

Capability	Negligible	Minor	Limited	Reasonable	Substantial	Significant	Formidable
Intent	Remote chance	Highly unlikely	Unlikely	Realistic possibility	Likely or probable	Highly certain	Almost certain

Related topics

• The Threat Selector tool
• Adding threats to RiskTrees