We look at how likely a weakness might be used and the damage it could cause. This depends on the weakness itself, the attacker's ability and goal, and current security steps.We also look at the asset's role, its value, and how sensitive it is to the organization.