The systematic identification and evaluation of potential threats to an organization or system, focusing on the likelihood and impact of each threat.