Mostly, threats are categorized in terms of probability and its impact, and further classified as high, medium, or low. Most risk analyzers determine the needs as per worst case scenarios, and assess the consequences resulting from the loss of infrastructure, operations, manpower, and data.