What term means any person, thing, or entity that acts or carries out a threat and is responsible for a threat event?

• A. Risk identification
• B. Risk taxonomy
• C. Threat actor
• D. Vulnerability assessment/analysis

Answer: (C)

In risk terminology, the term that names the person, group, organization, or other entity that acts to carry out a threat is threat actor. This is the agent responsible for initiating or enabling the threat event, whether they are an insider, an external attacker, a criminal group, a nation-state, or even an automated system acting on instructions. Identifying the threat actor helps you understand the attacker’s capabilities, resources, and intent, which influence how likely the threat is to occur and how much impact it could have. The other options describe processes or structures rather than the agent behind the threat: risk identification is about spotting what could go wrong, risk taxonomy covers how risks are categorized, and vulnerability assessment/analysis focuses on weaknesses that could be exploited.