trusselsanalyse

Trusselsanalyse is a systematic process for identifying, evaluating, and prioritizing threats to a system, organization, or project, with the aim of understanding risk and guiding protective measures. A threat is any potential cause of harm, including malicious actions, accidents, natural events, or failures that could compromise objectives or assets. The analysis considers threat sources, vulnerabilities, likelihood, and impact to produce a risk profile that informs decision-making.

Typical scope includes information systems, physical security, supply chains, and operational processes. The core steps are: define scope and critical assets; identify potential threats; assess vulnerabilities that could be exploited; evaluate the likelihood of each threat and its potential impact; determine overall risk and prioritize mitigations; implement controls and monitor effectiveness; and review the analysis as conditions change.

Common methods range from qualitative risk matrices to formal threat modeling approaches. In information security, threat modeling methods such as STRIDE or PASTA may be used, while broader risk-management efforts may follow standards such as OCTAVE or ISO/IEC 27005. The output is often a risk register and a prioritized mitigation plan, along with residual risk after controls are applied.

Applications span information security, physical security, critical infrastructure, healthcare, finance, and project management. Challenges include rapidly evolving threats, data quality, interdependencies among assets, and limited resources.

Note: The term is used in Danish and other Scandinavian languages, where "trussel" means threat; in English-language contexts the concept is generally called threat analysis or threat modeling.