A process used to identify potential threats to an organization's assets, systems, or infrastructure.