3. Threats, Adversaries and Attack Analysis

Introduction and Context

Cybersecurity is often described in terms of controls, technologies, and compliance requirements. Yet controls have meaning only when related to the adversaries and harmful activities they are intended to resist. A firewall, identity system, incident-response procedure, or security-monitoring platform is not evaluated in the abstract; its value depends on the threats confronting an organization, the resources and objectives of attackers, and the weaknesses through which attacks can succeed.

Threat analysis therefore provides the bridge between security theory and security decision-making. It asks who may attack, why they may attack, what capabilities they possess, how they operate, which vulnerabilities they exploit, and what consequences may follow. This chapter examines cybercrime, nation-state operations, insider threats, malware, social engineering, advanced persistent threats, attack lifecycles, the MITRE ATT&CK knowledge base, threat intelligence, and systemic vulnerabilities. It also considers the limits of technical models and the ethical responsibilities associated with studying adversarial behavior.

At doctoral level, threat analysis should not be treated as a catalogue of attack names. It is an interpretive and evidential activity. Analysts must distinguish observed facts from assumptions, separate capability from intent, estimate uncertainty, and understand how organizational, technological, economic, and political conditions interact. A technically sophisticated attack may fail because of poor timing or weak access to a target, while a simple phishing message may succeed because of organizational trust and inadequate recovery arrangements.

Learning Objectives

By the end of this chapter, students should be able to:

1. Distinguish major categories of cyber adversaries and explain their motives, capabilities, and constraints.

2. Analyze malware, social engineering, insider activity, and advanced persistent threats as socio-technical phenomena.

3. Apply attack-lifecycle models and MITRE ATT&CK to reconstruct and communicate adversarial behavior.

4. Evaluate the quality, uncertainty, and organizational value of cyber threat intelligence.

5. Identify systemic vulnerabilities that allow attacks to propagate across people, technologies, suppliers, and institutions.

6. Design proportionate defensive and governance responses while addressing ethical and legal considerations.

7. Critically assess the assumptions and limitations of common threat-analysis frameworks.

The Adversary as an Analytical Object

A threat is not simply a vulnerability, and it is not synonymous with an incident. A vulnerability is a condition that can be exploited; a threat is the possibility of harmful action; an attack is an intentional attempt to compromise confidentiality, integrity, availability, authenticity, or safety. Risk emerges from the interaction of threat, vulnerability, exposure, and consequence. This distinction matters because eliminating a particular vulnerability does not eliminate all threats, and detecting an attack does not necessarily reveal its strategic purpose.

Adversaries can be classified by motive, sponsorship, resources, target selection, and tolerance for exposure. These dimensions overlap rather than forming rigid categories. A criminal group may employ state-developed tools; a politically motivated collective may use criminal infrastructure; an employee may become an unwitting participant in a foreign intelligence operation.

Cybercriminals generally seek financial gain through fraud, extortion, theft, unauthorized cryptocurrency activity, or the sale of access and data. Their operations often reflect an underground service economy in which initial-access brokers, malware developers, money launderers, and ransomware operators specialize in different stages of the operation. This specialization lowers barriers to entry and complicates attribution.

Nation-state or state-linked actors pursue intelligence, strategic influence, military advantage, political coercion, or disruption of critical services. They may possess substantial resources, patience, legal protection within their jurisdictions, and access to intelligence unavailable to ordinary criminals. Their operations may seek secrecy for months or years rather than immediate monetization. Nevertheless, state affiliation is frequently uncertain; attribution is an analytical judgment based on technical, behavioral, contextual, and intelligence evidence, not merely on malware resemblance.

Hacktivists are motivated by ideological, political, or social causes. They may deface websites, conduct distributed denial-of-service attacks, leak documents, or manipulate public narratives. Terrorist groups have historically shown interest in using cyberspace for propaganda, recruitment, and disruption, although their technical capability varies considerably. Competitors, brokers, researchers, journalists, and security testers may also interact with sensitive systems, sometimes lawfully and sometimes abusively.

Insiders deserve separate treatment because they possess legitimate access, organizational knowledge, and familiarity with normal procedures. A malicious insider acts deliberately, whereas a negligent or compromised insider may cause harm without hostile intent. Insider risk is consequently a problem of trust, incentives, supervision, access design, and organizational culture—not simply employee misconduct. Excessively intrusive monitoring can damage privacy and morale, while insufficient monitoring can leave privileged misuse invisible.

From Malware to Manipulation: Principal Attack Mechanisms

Malware is software or code used to perform unauthorized or harmful actions. Its categories include ransomware, remote-access trojans, spyware, worms, botnet agents, rootkits, wipers, credential stealers, and malicious scripts. These labels describe functions rather than mutually exclusive families. One program may steal credentials, establish persistence, disable security tools, and encrypt files.

Ransomware illustrates the changing relationship between malware and business models. Contemporary campaigns may combine data theft with encryption and threaten publication, operational disruption, or repeated extortion. The technical payload is only one part of the attack. Initial access, privilege escalation, lateral movement, data discovery, negotiation, public relations, legal response, and restoration all influence the outcome. Backups reduce dependence on the attacker, but they are not sufficient if backup credentials are exposed or recovery procedures have never been tested.

Social engineering exploits human judgment, trust, authority, urgency, fear, or reciprocity. Phishing is commonly delivered through email, but similar techniques appear in messaging platforms, telephone calls, fraudulent support interactions, recruitment communications, and physical approaches. Spear-phishing is tailored to a person or organization; business email compromise often manipulates payment processes or executive authority without requiring sophisticated malware. Deepfakes and synthetic identities increase the challenge by making voice, video, and document evidence less reliable.

Social engineering should not be reduced to user error. Organizational procedures may reward speed, make verification difficult, or normalize exceptional requests. A payment clerk who bypasses a control under pressure is operating within a socio-technical system. Effective mitigation therefore combines awareness, clear escalation routes, transaction verification, technical filtering, least privilege, and a culture in which questioning an unusual request is supported.

Exploitation may involve technical weaknesses such as unpatched software, insecure interfaces, weak authentication, poor cryptographic implementation, or unsafe configuration. It may also exploit systemic weaknesses: concentration of suppliers, opaque software dependencies, inadequate incident reporting, fragmented responsibility, or incentives that prioritize availability and growth over resilience. The most serious vulnerabilities are often not single coding defects but relationships among systems that make failure cascade.

Advanced Persistent Threats and Attack Lifecycles

An advanced persistent threat (APT) is best understood as a campaign characterized by sustained access, adaptive behavior, and a strategic objective. “Advanced” does not mean that every tool is novel, and “persistent” does not necessarily mean continuous connection. The term emphasizes an adversary’s ability to return, change techniques, maintain access, and operate over time.

A useful attack-lifecycle interpretation begins with reconnaissance and resource development. The adversary identifies personnel, technologies, suppliers, public services, and organizational routines. It may register domains, acquire infrastructure, obtain credentials, or compromise a trusted service. Initial access follows through phishing, exploitation of a public-facing application, valid accounts, removable media, supply-chain compromise, or abuse of remote services.

Execution enables malicious commands or code. Persistence allows the adversary to survive restarts, credential changes, or partial remediation. Privilege escalation increases authority, while defense evasion reduces the likelihood of detection. Credential access, discovery, and lateral movement allow the adversary to understand and traverse the environment. Collection and command-and-control support the operational objective, which may be espionage, fraud, destruction, or coercion. Exfiltration and impact are often late stages, but an attacker may cause impact early if disruption is the immediate goal.

Lifecycle models are valuable because they turn a confusing incident into a sequence of hypotheses. They help analysts ask where the adversary entered, what assumptions were required, which controls should have interrupted the chain, and what evidence should remain. However, real intrusions are not linear. Attackers may move backward, repeat stages, operate several access paths simultaneously, or exploit legitimate administrative tools without introducing obvious malware. A lifecycle should therefore be used as an analytic lens rather than a claim that every attack follows a fixed order.

MITRE ATT&CK as a Common Analytical Language

MITRE ATT&CK is a publicly available knowledge base describing adversary tactics, techniques, and procedures. Tactics represent broad goals, such as credential access or discovery. Techniques describe methods used to achieve those goals, and sub-techniques provide greater specificity. Procedures are concrete examples of how a technique has been observed or may be implemented.

ATT&CK supports several professional activities. During detection engineering, defenders map analytics to techniques and identify gaps in visibility. During incident response, investigators use observed commands, persistence mechanisms, or account activity to develop hypotheses about adversary behavior. During threat hunting, the framework helps formulate questions that are independent of a particular malware brand. During executive communication, a technique-based description may be more useful than an uncertain claim about the attacker’s identity.

The framework must nevertheless be applied critically. ATT&CK is not a complete taxonomy of all threats, a probability model, or a checklist that proves security maturity. Technique coverage does not equal defensive effectiveness. An organization may have a detection rule for a technique but lack the staffing or response authority to act on it. Conversely, a technique may be difficult to observe in a cloud or operational-technology environment. Mapping should be evidence-based, transparent about confidence, and connected to assets, business processes, and consequences.

Threat Intelligence: From Data to Judgment

Threat intelligence is analyzed information about threats that supports decisions. Raw indicators—such as an IP address, file hash, domain, or suspicious command—become intelligence only when evaluated, contextualized, and related to a decision. Intelligence may be strategic, operational, tactical, or technical. Strategic intelligence addresses trends, motives, and business consequences. Operational intelligence examines campaigns and adversary activity. Tactical intelligence concerns methods and defensive priorities. Technical intelligence supports immediate detection and blocking.

A disciplined intelligence process usually includes direction, collection, processing, analysis, dissemination, and feedback. Direction defines the decision or intelligence requirement: for example, whether a supplier presents a credible risk or whether a detected identity pattern indicates account takeover. Collection draws on internal telemetry, incident reports, security researchers, government advisories, vendors, industry groups, and lawful open sources. Processing normalizes and enriches the material. Analysis evaluates competing explanations, confidence, relevance, and likely consequences.

Good intelligence communicates uncertainty rather than hiding it. Analysts should distinguish facts, judgments, assumptions, and unknowns. Confidence may be increased by independent corroboration, temporal consistency, technical feasibility, and alignment with known behavior. Attribution should be expressed cautiously because attackers reuse tools, imitate other groups, purchase access, and deliberately plant misleading evidence. A useful intelligence product states what is known, what is inferred, what action is recommended, and what evidence would change the assessment.

Threat intelligence platforms and machine-learning systems can accelerate collection, correlation, and anomaly detection. They can cluster infrastructure, prioritize alerts, and identify deviations from established behavior. Their limitations include biased training data, false positives, adversarial manipulation, privacy concerns, and the risk of confusing correlation with causation. Automation should support analyst judgment, not remove accountability from high-consequence decisions.

Systemic Vulnerability and Adversarial Behavior

Many security failures arise from systems rather than isolated actors. Systemic vulnerability refers to conditions in which architecture, governance, market structure, institutional dependence, or human practice creates widespread exposure. Examples include common software dependencies, centralized identity providers, insecure legacy protocols, excessive concentration in cloud services, weak software-update ecosystems, and unclear responsibility across suppliers.

A systemic perspective changes the unit of analysis. Instead of asking only, “Which host was compromised?” the analyst asks, “Why could compromise of this host affect these services?” Instead of asking only whether an employee violated policy, the analyst investigates whether policies were usable, whether incentives encouraged circumvention, and whether authority was appropriately distributed.

Adversaries also behave strategically. They select paths that minimize cost and detection, exploit defenders’ assumptions, and adapt to controls. A security measure can produce displacement: blocking one channel may shift attacks to another. An attacker may intentionally create noisy activity to conceal a quiet intrusion, or target a low-security supplier to reach a better-protected customer. Defensive analysis should therefore consider second-order effects and the likely adaptation of intelligent opponents.

An Applied Case: The Northbridge Health Network Intrusion

The following is an illustrative case constructed for analysis. Northbridge Health Network operates hospitals, outpatient clinics, laboratories, and a patient portal. It relies on a managed service provider for remote administration and exchanges clinical information with external partners.

Background. Northbridge had invested in endpoint protection and annual awareness training. Its identity environment contained several legacy service accounts, and remote administrative access was permitted through a single gateway. Clinical availability was prioritized, so some systems could not be rapidly patched without operational testing.

Situation. The finance department received a convincing message appearing to come from a senior executive. The message requested an urgent change to a supplier bank account. At approximately the same time, security monitoring recorded a successful login to a remote administrative account from an unusual location. The organization initially treated these as unrelated events. Two weeks later, abnormal queries were observed against a laboratory database, followed by encryption of selected file servers and publication threats concerning stolen patient information.

Analysis. Investigation found that the executive’s mailbox had been accessed through a stolen session token. The attacker used information from the mailbox to construct the payment request and identify the managed service provider. A dormant service account at the provider was then used to access Northbridge. The attacker performed discovery with legitimate administrative tools, created persistence through a scheduled task, collected database records, and finally deployed ransomware. The event combined social engineering, valid-account abuse, supply-chain exposure, discovery, collection, exfiltration, and impact.

A simplistic analysis would label the incident a phishing failure. A broader analysis identifies layered weaknesses: inadequate session protection, excessive trust in supplier access, long-lived service accounts, insufficient segmentation, weak verification of financial changes, limited monitoring of administrative activity, and untested recovery assumptions. ATT&CK mapping would help organize observed behavior, while intelligence from the provider and health sector could establish whether similar infrastructure or procedures were being used elsewhere.

Approach and response. Northbridge isolated affected systems while preserving forensic evidence, moved critical communications to trusted channels, and engaged legal, clinical, privacy, and law-enforcement advisers. It disabled unnecessary supplier accounts, rotated credentials, revoked sessions, and applied emergency segmentation. Recovery was prioritized according to patient safety rather than purely technical restoration. The organization validated offline backups and rebuilt compromised systems instead of assuming that deleting the ransomware would remove persistence.

Longer-term measures included phishing-resistant authentication for privileged users, just-in-time supplier access, independent verification of payment changes, centralized logging, service-account reduction, network segmentation, tested downtime procedures, and contractual requirements for supplier notification and evidence sharing.

Outcome and learning points. The organization restored essential services, but the incident revealed that strong endpoint tools could not compensate for weak identity governance and concentrated supplier trust. The main lesson is that attack analysis must connect technical events with business processes and institutional dependencies. Another lesson is that resilience depends on preparation before detection: recovery authority, reliable backups, communication plans, and practiced decision rights are security controls.

Challenges, Limitations, and Common Errors

Threat analysis is affected by incomplete visibility. Logs may be missing, systems may be overwritten, cloud providers may control relevant evidence, and victims may delay reporting. Analysts can also suffer from confirmation bias, anchoring on a familiar threat group, or treating an indicator as proof of attribution. A malware family may be copied, a compromised server may be shared by unrelated actors, and a legitimate administrative tool may be used by both defenders and attackers.

Another error is equating vulnerability counts with risk. A high-severity flaw on an isolated, well-monitored system may pose less immediate risk than a modest weakness in a highly connected identity service. Similarly, the existence of a control does not establish that it is correctly configured, observed, maintained, and usable under pressure.

Frameworks can create false precision. Lifecycle stages and ATT&CK mappings structure thought, but they do not calculate probability or consequence automatically. Risk assessments should document assumptions, confidence, alternative explanations, and the evidence required for revision. Analysts should also avoid operationalizing sensitive threat information in ways that expose individuals or enable unlawful surveillance.

Ethics, Governance, and Professional Responsibility

Cybersecurity professionals regularly handle personal data, employee communications, forensic images, and intelligence from uncertain sources. Collection must be lawful, necessary, proportionate, and governed by access controls and retention rules. Threat hunting should not become unrestricted surveillance. Organizations should define who may authorize intrusive investigation, how evidence is protected, and how affected individuals are notified.

Attribution and public disclosure require particular care. Incorrect accusations can harm individuals, organizations, and international relations. Responsible reporting distinguishes evidence from assessment and avoids publishing details that would materially increase risk. Research involving malware, exploit reproduction, or adversary infrastructure should follow institutional policy, legal requirements, coordinated disclosure practices, and clear authorization boundaries.

Governance also requires accountability for automated decisions. If an analytic model blocks an account, labels a person as suspicious, or prioritizes a supplier for investigation, the organization should understand the model’s basis, monitor error, and provide appropriate human review. Security objectives must be balanced with privacy, due process, safety, and continuity of essential services.

Current Developments and Best Practices

Threat analysis is increasingly influenced by cloud-native architectures, identity-centric attacks, software supply-chain compromise, ransomware ecosystems, deepfake-enabled fraud, and the use of generative artificial intelligence by both attackers and defenders. Artificial intelligence can produce persuasive content, automate reconnaissance, and adapt malicious code; it can also support detection, summarization, malware triage, and investigation. The central question is not whether AI is present, but whether its use changes attack scale, speed, uncertainty, or accountability.

Organizations should adopt a risk-informed and evidence-driven practice. Important measures include:

• Maintain accurate asset, identity, dependency, and data inventories.
• Use threat modeling to connect adversaries and attack paths to business consequences.
• Apply least privilege, strong authentication, segmentation, secure configuration, and timely patching.
• Monitor identity behavior, administrative actions, cloud control planes, and supplier connections.
• Use ATT&CK or comparable models to test detection and response coverage, not merely to produce documentation.
• Develop intelligence requirements linked to concrete decisions.
• Preserve logs and forensic evidence according to legal and operational needs.
• Exercise incident response, crisis communication, business continuity, and recovery procedures.
• Measure control effectiveness through meaningful outcomes such as detection time, containment quality, recovery confidence, and reduction of exploitable paths.
• Review assumptions after incidents and share lessons through trusted, lawful channels.

Chapter Summary

Threat and attack analysis examines the interaction among adversary objectives, capabilities, vulnerabilities, organizational conditions, and consequences. Cybercriminals, nation-state actors, hacktivists, insiders, and compromised third parties differ in motive and resources, but their activities may overlap. Malware and social engineering are most effective when supported by weaknesses in identity, process, architecture, and governance. APTs are campaigns involving persistence and adaptation rather than merely advanced software.

Attack-lifecycle models and MITRE ATT&CK provide useful languages for reconstructing behavior, developing detections, and identifying defensive gaps, but they are analytical aids rather than complete theories or probability models. Threat intelligence becomes valuable when it transforms evidence into a decision while expressing uncertainty. A systemic perspective is essential because modern attacks exploit dependencies among people, suppliers, software, institutions, and critical services. Effective practice combines technical controls, organizational resilience, ethical governance, careful attribution, and continuous learning.

Key Terms

Threat: The possibility that an adverse event or actor will cause harm.

Adversary: An individual, group, organization, or state capable of conducting hostile activity.

Vulnerability: A weakness or condition that can be exploited to produce an unwanted outcome.

Attack: An intentional attempt to compromise an asset, service, or security property.

Cybercrime: Criminal activity in which digital systems, networks, or data are tools, targets, or environments.

Nation-state actor: A state-sponsored or state-aligned actor conducting operations for strategic purposes.

Insider threat: Risk arising from a trusted person’s intentional, negligent, or compromised activity.

Malware: Software designed or used to perform unauthorized or harmful actions.

Social engineering: Manipulation of human judgment or behavior to obtain access, information, or action.

Advanced persistent threat: A sustained, adaptive campaign conducted to achieve a strategic objective.

Persistence: Techniques used to maintain access despite interruption or remediation.

Lateral movement: Activity used to move from one system, account, or network segment to another.

MITRE ATT&CK: A knowledge base organizing adversary tactics, techniques, sub-techniques, and procedures.

Threat intelligence: Evaluated information about threats that supports security decisions.

Indicator: An observable artifact associated with possible malicious activity.

Attribution: An assessment concerning the actor responsible for an operation.

Systemic vulnerability: Exposure produced by relationships among technical, organizational, institutional, or market conditions.

Attack surface: The set of accessible points through which an asset or organization may be attacked.

Defense evasion: Adversary behavior intended to avoid detection or hinder security controls.

Resilience: The capacity to withstand, adapt to, recover from, and learn from disruptive events.

Review Questions

Short Answer Questions

1. Distinguish a threat, vulnerability, attack, and risk.

2. Why should insider threat include negligent and compromised insiders as well as malicious insiders?

3. What is the difference between a tactic, technique, and procedure in MITRE ATT&CK?

4. Why is threat intelligence more than a collection of indicators?

5. Explain why an attack lifecycle should not be interpreted as strictly linear.

Long Answer Questions

1. Compare cybercriminal and nation-state adversaries in terms of motivation, resources, persistence, and operational constraints.

2. Explain how social engineering exploits socio-technical conditions rather than merely individual carelessness.

3. Describe how MITRE ATT&CK can support detection engineering, threat hunting, and incident response, and evaluate its limitations.

4. Discuss the relationship between APT behavior, attack lifecycles, and systemic vulnerabilities.

5. Explain the ethical and governance issues involved in attribution, threat hunting, intelligence collection, and automated security decisions.

Analytical / Application Questions

1. An organization has strong endpoint protection but permits long-lived supplier accounts and shared administrative credentials. Analyze the likely attack paths and propose prioritized controls.

2. A security team observes valid-account logins, unusual database queries, and a new scheduled task but has no malware sample. Explain how you would develop competing hypotheses using ATT&CK and threat-intelligence principles.

3. Following a ransomware incident, executives request a single measure of “security maturity.” Critique this request and propose a balanced set of effectiveness and resilience measures.

22. Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes a vulnerability from a threat?

A. A vulnerability is an adverse actor, while a threat is a software defect.

B. A vulnerability is an exploitable weakness, while a threat is the possibility of harmful action.

C. A vulnerability is always intentional, while a threat is always accidental.

D. A vulnerability describes impact, while a threat describes recovery.

Correct Answer: B. A vulnerability is an exploitable weakness, while a threat is the possibility of harmful action.

Question 2

Why can a technically strong endpoint-control program fail to prevent a major intrusion?

A. Endpoint controls eliminate the need for identity governance.

B. Attackers can only succeed when malware is undetectable.

C. Weak identity, supplier, process, or architectural controls may provide alternative attack paths.

D. Endpoint controls are relevant only to physical security.

Correct Answer: C. Weak identity, supplier, process, or architectural controls may provide alternative attack paths.

Question 3

In MITRE ATT&CK, a tactic primarily represents:

A. A broad adversary objective, such as credential access or discovery.

B. A specific file hash associated with malware.

C. The legal identity of an attacker.

D. A numerical probability of compromise.

Correct Answer: A. A broad adversary objective, such as credential access or discovery.

Question 4

Which observation most strongly illustrates systemic vulnerability?

A. One employee chooses a weak password.

B. A single workstation displays an error message.

C. A common identity provider failure disrupts many dependent services.

D. A security analyst misclassifies one alert.

Correct Answer: C. A common identity provider failure disrupts many dependent services.

Question 5

Which practice best reflects high-quality threat intelligence?

A. Publishing every indicator without context.

B. Presenting attribution as certain whenever malware resembles a known family.

C. Linking evaluated evidence and uncertainty to a specific decision.

D. Replacing internal telemetry with vendor reports.

Correct Answer: C. Linking evaluated evidence and uncertainty to a specific decision.

Question 6

An attacker uses legitimate administrative tools to discover systems and create a scheduled task. What is the most appropriate analytical conclusion?

A. No attack occurred because no custom malware was found.

B. The behavior may represent discovery and persistence while evading simple malware detection.

C. The attacker must be a nation-state actor.

D. The scheduled task proves the original phishing message was unrelated.

Correct Answer: B. The behavior may represent discovery and persistence while evading simple malware detection.

Question 7

Why is the term advanced persistent threat potentially misleading if interpreted carelessly?

A. APT campaigns never use ordinary tools.

B. Every APT maintains a continuous connection to the target.

C. The terms describe campaign characteristics, not a guarantee of novel tools or uninterrupted access.

D. APT activity is limited to financial crime.

Correct Answer: C. The terms describe campaign characteristics, not a guarantee of novel tools or uninterrupted access.

Question 8

Which response most directly reduces the risk of fraudulent executive payment requests?

A. Increasing website bandwidth.

B. Independent verification of payment changes through a trusted channel.

C. Deleting all historical email.

D. Allowing executives to approve changes without review.

Correct Answer: B. Independent verification of payment changes through a trusted channel.

Question 9

What is the principal danger of treating an attack lifecycle as a fixed sequence?

A. It prevents organizations from using logs.

B. It may obscure repeated, parallel, or non-linear adversary behavior.

C. It makes vulnerability scanning impossible.

D. It guarantees excessive encryption.

Correct Answer: B. It may obscure repeated, parallel, or non-linear adversary behavior.

Question 10

Which statement best reflects responsible attribution?

A. Attribution should be based solely on malware appearance.

B. Attribution is an evidence-based assessment that should communicate uncertainty.

C. Attribution is unnecessary in all incident investigations.

D. Attribution is certain whenever an attack originates from a known country.

Correct Answer: B. Attribution is an evidence-based assessment that should communicate uncertainty.