Threat

Something that can go wrong: the unit of threat modeling. Contained in the asset it targets; categorized in any number of taxonomies (crosswalk); mitigated by governance controls; elevated into the governance risk register when it survives analysis. Contains child threats: an attack tree, with the root as goal and leaves as steps.