In threat analysis, indicators are best described as which of the following?

In threat analysis, indicators are best described as which of the following?

• A. A sign that a vulnerability exists
• B. A sign that a threat may occur
• C. A sign that a control has failed
• D. A sign that an asset is safe

Answer: (B)

Indicators are signals that a threat may occur. They are observable signs—patterns, behaviors, or anomalies—that suggest an adversary is active or about to act, helping investigators anticipate and prepare defenses before an attack unfolds. For example, a rise in spear-phishing emails, repeated login attempts from unfamiliar locations, or reconnaissance activity like unusual network scanning all point to a potential imminent threat. This differs from signs that merely indicate a vulnerability exists, a control has failed, or that an asset is safe; indicators specifically signal possible future threat activity, making them the best description in threat analysis.

Indicators are signals that a threat may occur. They are observable signs—patterns, behaviors, or anomalies—that suggest an adversary is active or about to act, helping investigators anticipate and prepare defenses before an attack unfolds. For example, a rise in spear-phishing emails, repeated login attempts from unfamiliar locations, or reconnaissance activity like unusual network scanning all point to a potential imminent threat. This differs from signs that merely indicate a vulnerability exists, a control has failed, or that an asset is safe; indicators specifically signal possible future threat activity, making them the best description in threat analysis.