The Prioritization Problem
A thorough threat modeling session on a medium-complexity system can produce 30 to 80 identified threats. You cannot fix all of them before the next release. You need a principled way to decide what to address first, what to schedule for later, and what risk to formally accept.
DREAD Scoring
DREAD is a scoring model developed at Microsoft to quantify the risk of each identified threat. For each threat, you score five dimensions from 1 (low) to 10 (high):
| Dimension | Question to Ask | Score 1 (Low) | Score 10 (High) |
|---|---|---|---|
| Damage | How bad is the worst-case outcome? | Minor inconvenience | Full data breach, business shutdown |
| Reproducibility | How reliably can the attack be repeated? | Requires rare conditions | Works every time with a script |
| Exploitability | How much skill does the attack require? | Nation-state level expertise | Script kiddie with a tutorial |
| Affected Users | What fraction of users are impacted? | One internal user | Every user of the system |
| Discoverability | How easy is it to find this vulnerability? | Requires deep source code access | Visible in the browser URL bar |
The DREAD score is the average: (D + R + E + A + D) / 5. Threats scoring above 7 are typically treated as high priority.
The Limitations of DREAD
DREAD scoring is subjective. Two engineers scoring the same threat will often disagree on "Exploitability" by 3 or 4 points. This subjectivity can make the scores feel authoritative while actually encoding hidden assumptions. Modern threat modeling programs often replace DREAD with a simpler 2×2 risk matrix plotting Impact (low/medium/high/critical) against Likelihood (rare/possible/likely/almost certain). The quadrant a threat falls in determines its priority tier.
The right tool depends on your organization's maturity. DREAD is useful for teams that want a structured conversation about risk dimensions. A risk matrix is faster and easier to align on across teams. Both are better than gut feeling.