DREAD

Definition

DREAD is a risk-ranking framework that helps engineers measure how serious each threat is. After STRIDE identifies possible threats, DREAD assigns a score so teams know which problems should be fixed first.

The Problem That Led to It

STRIDE can identify many threats, but organizations usually have limited time and money. Fixing everything at once isn't practical. Engineers needed a way to determine which threats posed the greatest risk and deserved immediate attention.

What Problem It Solves

DREAD scores each threat using five factors:

• D – Damage: How much harm could it cause?
• R – Reproducibility: Can the attack be repeated easily?
• E – Exploitability: How easy is it to perform?
• A – Affected Users: How many users are impacted?
• D – Discoverability: How easy is it to find the weakness?

Higher scores mean higher priority.

What Happens If Not Used

Teams may spend time fixing minor issues while dangerous vulnerabilities remain exposed.

Easy Wording

DREAD is a scoring system that tells you which security threats are the most dangerous.

Layman Example

Imagine finding five cracks in a bridge. You repair the largest crack first because it is most likely to cause the bridge to collapse. DREAD helps engineers prioritize security problems in the same way.

Technical Example

Before DREAD

• STRIDE identifies 10 threats.
• Engineers don't know which to fix first.
• Important threats may be delayed.

After DREAD

• Score each threat using the five DREAD factors.
• Compare the scores.
• Fix the highest-risk threats first.
• Address lower-risk threats later.

Limitation

DREAD ranks how serious a threat is, but it does not describe how attackers actually perform real-world attacks.

Solution

The next concept is MITRE ATT&CK (and ATT&CK for ICS), a knowledge base of real attack techniques used by actual attackers. Engineers use it to understand how cyberattacks happen in practice and strengthen their defenses accordingly.