anything – for example, an object, substance, individual, or group – that is capable of acting against an asset in a manner that can result in harm This can be intentional; e.g., a human attacker, but also unintentional; e.g., a well-intentioned, but inept, computer operator who trashes a daily batch job by typing the wrong command.