In risk assessment, how is likelihood defined and estimated?

In risk assessment, how is likelihood defined and estimated?

• A. Damage potential of a successful breach
• B. Number of vulnerabilities present in a system
• C. Time to patch a vulnerability
• D. Probability that a threat will exploit a vulnerability; estimated from historical data, threat modeling, and control effectiveness

Answer: (D)