In a typical OT risk model, which factors are multiplied to compute risk?

In a typical OT risk model, which factors are multiplied to compute risk?

• A. Likelihood of exploit, impact, and vulnerability level
• B. Threat frequency, asset value, and maintenance cost
• C. Probability of failure, detection rate, and recovery cost
• D. Complexity, weather, and vendor support

Answer: (A)

In OT risk modeling, risk is treated as the product of how likely an exploit is, the potential impact if it occurs, and how vulnerable the asset is. This means the risk grows when an attacker is likely to succeed, the consequences would be severe, and the asset is highly exposed to exploitation. Each element matters: the likelihood of exploit captures the chance an attacker can actually take advantage of a weakness; the impact reflects safety, reliability, uptime, and environmental or financial consequences; the vulnerability level represents how exposed or susceptible the asset is given existing controls. Multiplying these three factors yields a risk value that scales with more probable, costlier, and more exposed scenarios. The other options mix factors (like maintenance costs, detection rates, or weather and vendor support) that influence risk indirectly or represent costs and controls rather than the core risk calculation.

In OT risk modeling, risk is treated as the product of how likely an exploit is, the potential impact if it occurs, and how vulnerable the asset is. This means the risk grows when an attacker is likely to succeed, the consequences would be severe, and the asset is highly exposed to exploitation. Each element matters: the likelihood of exploit captures the chance an attacker can actually take advantage of a weakness; the impact reflects safety, reliability, uptime, and environmental or financial consequences; the vulnerability level represents how exposed or susceptible the asset is given existing controls. Multiplying these three factors yields a risk value that scales with more probable, costlier, and more exposed scenarios. The other options mix factors (like maintenance costs, detection rates, or weather and vendor support) that influence risk indirectly or represent costs and controls rather than the core risk calculation.