A method of characterizing malicious activity in an intelligent utility grid system, the method executable by a computer having at least one processor and at least one memory, comprising: receiving, by the at least one processor, first data including IT-related activity from the intelligent grid system; receiving, by the at least one processor, second data including location-specific event data from a plurality of electronic sources; grid analog measurements comprising phasor measurements; and a list of targets and corresponding geographic locations; pre-processing, by the at least one processor, the second data including: disregarding the second data failing to meet a predetermined level of relevance to one of a plurality of risk-related events; applying, by the at least one processor, a plurality of rules to the pre-processed second data by: associating an undesired event with reference to the IT-related activity; and determining a probability that the undesired event is indicative of malicious activity including comparing predetermined criteria to the second data to generate one of a plurality of probability levels as a sum of: a product of a probability of occurrence of an intentional malicious attack and a probability of existence of a vulnerability exploitable by the intentional malicious attack; and a product of a probability of occurrence of an unexpected hazard and a probability of existence of a vulnerability associated with the unexpected hazard, where the intentional malicious attack and the unexpected hazard comprise mutually independent events; and applying, by the at least one processor, a risk characterization to the undesired event associated with the IT-related activity, wherein the risk characterization comprises an indication of either: an unintentional or unexpected hazard, or a malicious attack based on the determined probability. receiving, by the at least one processor, first data including IT-related activity from the intelligent grid system; receiving, by the at least one processor, second data including location-specific event data from a plurality of electronic sources; grid analog measurements comprising phasor measurements; and a list of targets and corresponding geographic locations; pre-processing, by the at least one processor, the second data including: disregarding the second data failing to meet a predetermined level of relevance to one of a plurality of risk-related events; applying, by the at least one processor, a plurality of rules to the pre-processed second data by: associating an undesired event with reference to the IT-related activity; and determining a probability that the undesired event is indicative of malicious activity including comparing predetermined criteria to the second data to generate one of a plurality of probability levels as a sum of: a product of a probability of occurrence of an intentional malicious attack and a probability of existence of a vulnerability exploitable by the intentional malicious attack; and a product of a probability of occurrence of an unexpected hazard and a probability of existence of a vulnerability associated with the unexpected hazard, where the intentional malicious attack and the unexpected hazard comprise mutually independent events; and associating an undesired event with reference to the IT-related activity; and determining a probability that the undesired event is indicative of malicious activity including comparing predetermined criteria to the second data to generate one of a plurality of probability levels as a sum of: a product of a probability of occurrence of an intentional malicious attack and a probability of existence of a vulnerability exploitable by the intentional malicious attack; and a product of a probability of occurrence of an unexpected hazard and a probability of existence of a vulnerability associated with the unexpected hazard, where the intentional malicious attack and the unexpected hazard comprise mutually independent events; and a product of a probability of occurrence of an intentional malicious attack and a probability of existence of a vulnerability exploitable by the intentional malicious attack; and a product of a probability of occurrence of an unexpected hazard and a probability of existence of a vulnerability associated with the unexpected hazard, applying, by the at least one processor, a risk characterization to the undesired event associated with the IT-related activity, wherein the risk characterization comprises an indication of either: an unintentional or unexpected hazard, or a malicious attack an unintentional or unexpected hazard, or a malicious attack