In a threat model, how do you rate the likelihood that a warehouse picker's handheld can post fraudulent stock write-offs?

## What likelihood means before anything is built When you rate a threat you found on a diagram, you have no exploit, no proof of concept and no incident record for this system. Likelihood cannot be a measured frequency. In qualitative threat modeling it is a **proxy for how much has to go right for the attacker**: what access they must already hold, how much effort, skill and equipment the abuse costs them, whether they would stumble on it, and whether the system would notice. That is why the same technical finding gets a different likelihood in two different systems — the finding did not change, the attacker's starting position did. ## Required access is usually the dominant factor Start by naming the attacker position the threat assumes, then count the population that occupies it. A threat that needs a signed-in employee with an issued device is not "internal, therefore unlikely" — in a warehouse that population is hundreds of people, many of them seasonal, some of them leavers whose accounts linger, and some working under a shared shift login. A threat that needs a specific administrator plus a hardware key is a population of three. The size and trust level of that population moves likelihood more than any other single input, and it is the input engineers most often skip because it is an organisational fact rather than a technical one. ## Effort and skill, not cleverness The second input is what the abuse actually costs to perform. Posting a write-off for goods that were never damaged uses the application exactly as designed; the attacker needs no tooling, no timing and no understanding of the internals. Compare that with a threat that needs a race window hit repeatedly, or a stolen signing key. Teams routinely invert this: they rate a boring business-logic abuse low because it is not "a real hack", and rate an exotic memory-corruption path high because it sounds dangerous. The exotic path is usually the less likely one — it demands rare skill and rare access. Impressiveness is not likelihood. ## Motive and opportunity Ask who benefits and how directly. Stock write-offs convert to resellable goods, and the same feature also covers up an ordinary picking mistake, so there is both a fraud motive and a much more common careless-concealment motive. Opportunity is about how often the attacker is in position: a picker is in position every shift, unsupervised, for hours. ## Detection cuts likelihood Whether the abuse would be spotted belongs on the likelihood side, not the impact side. An attacker who will be caught after the first attempt cannot iterate, cannot scale the theft, and is deterred if they know monitoring exists. So "write-offs above a threshold are reviewed weekly against a physical count" genuinely lowers likelihood; "write-offs are written to a log nobody reads" does not. Note the direction carefully — good detection lowers likelihood, absent detection raises it. ## Existing controls and what you are rating Decide explicitly whether you are rating the threat as designed, with today's controls in place (residual), or as it would be with none of them (inherent). Both are defensible; mixing them inside one model is not, because two threats then become incomparable. Write the assumption next to the rating. A control that requires a second person to approve large write-offs moves the required access from one picker to two colluding people — that is a real likelihood reduction, and it also caps how much a single unapproved event can remove, which is an impact reduction. ## Keep the axes separate The most common rating error is smuggling impact into likelihood or the reverse. "It could take out a whole store's inventory value" is an impact statement. "You would need the district manager's account" is a likelihood statement. If your likelihood sentence contains a money figure, you have mixed them. Likewise, resist inventing a percentage: "5% chance per quarter" reads as measurement while resting on nothing, and it invites arithmetic the underlying judgment cannot support. Say high / medium / low, and say what access and effort put it there. ## What a good answer sounds like "Likelihood is high. The required access is issued to every picker, the abuse is the ordinary write-off flow with false data, discovery is accidental rather than skilled, and nothing reconciles write-offs against physical stock — so an abuser can repeat it indefinitely without being noticed." Every clause is about access, effort or detection, and none of it is about how much money is lost.