Identifying weaknesses or vulnerabilities in a system that could potentially be exploited as a means of causing harm.