PG&E had a pretty good handle on vulnerabilities, but didn’t have a great way of measuring threats. The utility company developed a threat assessment system that would answer this question. It’s inexpensive, easy to maintain and–most important–it helps him sleep at night. If a known threat agent has the capability to exploit a known vulnerability, it gets priority treatment. The best thing about the system is that even if it misjudges a threat, the security team can adjust the matrix.”]
Source: https://www.csoonline.com/article/2122540/how-to-prioritize-threats–without-spending-big-bucks-.html