A threat is not a risk.
A risk is not a threat.
What is a threat?
A threat is not a risk. A risk is not a threat. See the briefing on "risk".
A threat is distinguished from a hazard by human intent: it is an actor intending to use a hazard's potential for harm. However, this slight distinction is sometimes neglected and the term threat is used as a synonym for hazard.
Recommendations
The distinction between a hazard and a threat is critical to ensure the "human intent" vector is not overlooked. A professional risk assessment and management must explicitly take into account a possible threat of a malicious actor, not just the technical hazard, to ensure this vector is not left untreated.
Author
Claudia Otto
As a lawyer and researcher, Claudia specializes in AI safety, security, and risk assessment under the EU AI Act, the subject of her Master's thesis in Security and Disaster Management (MBA).
Need guidance on risk and compliance?
Cite this briefing
Otto, AI Risk Literacy, What is a threat?, September 2025