A **threat** is any circumstance or event that can negatively impact assets. A organisation’s assets should be defended from inside and outside threats. Common threats include: - [[Insider Threats]]: Staff members or vendors abuse their authorised access to obtain data that may harm an organization. - Advanced persistent threats ([[Advanced Persistent Threats|APTs]]): A threat actor maintains unauthorised access to a system for an extended period of time.