Definition
DREAD is a qualitative risk assessment model used to evaluate the potential impact of security threats. It stands for Damage potential, Reproducibility, Exploitability, Affected users, and Discoverability, with each factor assigned a score to calculate an overall risk rating. This framework helps security professionals prioritize vulnerabilities and allocate resources effectively by quantifying the severity of potential attacks. For instance, a flaw allowing widespread data theft with minimal effort would score high across multiple DREAD categories. Unlike quantitative models that use numerical data, DREAD relies on subjective expert judgment. It is a valuable concept for professionals preparing for certifications like CompTIA Security+ and CISSP.