of an attacker, or what an attacker might try to do to a system. Threats always exist, regardless of mitigation.