Threat, Vulnerability, and Risk Assessments (TVRA): Why You Should Run Them

Understanding threats, vulnerabilities, and risks is key to effectively protecting the people and assets that matter most to you. A comprehensive Threat, Vulnerability, and Risk Assessment (TVRA) enables you to minimize the risk of intentional harm or unintentional hazards that could impact your family, home, and/or your business. TVRAs provide insight into threats, identify any gaps in the existing safety and security measures, and outline tailored recommendations to fill those gaps, ensuring comprehensive protection for you, your family, your home, and/or your business in an uncertain world.

‍Assets

‍Each TVRA starts with the question: “What are we trying to protect?” Protected assets may include people, sensitive information, valuable possessions, technical equipment, facilities, or other valuables. The answer varies for each person, family, or business, and each assessment is tailored to the subject’s specific priorities. Characterizing the assets is critical to understanding how to safeguard them.

‍Threats

‍Once we know what we are protecting, the TVRA asks: “What are we protecting against?” A TVRA analyzes both unintentional hazards, such as accidents and natural disasters, and intentional threats by an adversary to cause harm. Threats may come in many forms, such as kidnapping, physical harm, civil unrest, breach of information, or reputation damage.The threat picture varies across people, geography, and industry, so a TVRA considers the threats that are specific to you and your assets. For example, a tech firm’s CEO, a famous media personality, a high net worth family, and a Fortune 50 company’s headquarters facility may each face different threats and require unique threat assessments.

‍Vulnerabilities

‍Next, the TVRA evaluates: “Are the assets well protected from the identified threats?” Are there countermeasures and defenses in place to deter or stop would-be attackers, or prevent accidents? An incomplete or dysfunctional security posture leaves your assets vulnerable to adversaries, who can take advantage of security gaps.A TVRA reviews the entire security program in place and identifies gaps or weaknesses, if any exist. Vulnerabilities may be present in various aspects of the security posture, such as physical protection (barriers, doors, lock mechanisms), alarm systems, video surveillance, policies and procedures, and emergency response, among others.

‍Risks

‍Once we know the strength of the threats and have identified any vulnerabilities, the TVRA calculates: “What is the likelihood of a successful attack?” For example, how likely is it that a violent criminal would target your home and succeed at gaining entry? Or how likely is your business to be targeted by activist groups and how successful would they be if they attempted to protest at your office?The risk assessment is the intersection of threat and vulnerability; it takes into consideration which specific types of threats are most prevalent for you and how well protected you are from each type of threat. TVRA risk ratings help you to understand the comprehensive security picture and prioritize the most critical risks to you, your family, your home, and/or your business.A comprehensive risk assessment also considers the impact and consequences of a successful attack, based on your individual priorities. Impacts of an attack may include loss of life, severe bodily harm, reputation damage, financial loss, or extreme inconvenience.

TVRAs use Design Basis Threat (DBT) Scenarios to illustrate realistic examples of threats, vulnerabilities, and the likelihood and impacts of an attack on your specific assets.

‍Recommendations

‍Finally, the TVRA determines: “How do we mitigate the identified risks?” The assessment prioritizes recommendations based on risk level, aimed at protecting the assets and filling any security gaps. All recommendations are composed specifically for the target people, property, or business. For example, we may recommend that a high-profile and controversial politician better secure his or her home with certain access control, intrusion detection, and emergency preparedness measures to protect his or her family against a politically-motivated violent intruder. Or we may recommend that a company develop specific policies and procedures pertaining to employee vetting in order to protect against a potentially dangerous hire.

‍So, what are the most significant threats, vulnerabilities, and risks to you, your family, your property, or your business? Red Five’s TVRA determines the ratings for each relevant threat, vulnerability, and risk, and prioritizes recommendations so you understand the greatest issues and know how to protect against them.