← ACARA Digital Technologies Years 9–10

Writing a threat statement

One sentence naming the actor, the vulnerability they use, the asset at risk and the impact, using because to link cause and effect.

Part of: ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 51

Understanding Writing a threat statement in ACARA Digital Technologies Years 9–10

What it does: The scammer is the actor, the reused weak password is the vulnerability, the bank account is the asset and stolen money is the impact, all in one sentence. The impact (leaked records) is explained by the cause (default login details) using because, with the asset (student records) clearly named. A threat statement packs four things into one sentence: who attacks, what weakness they use, what is at risk and what harm results. Using because shows why the attack is possible, so the reader can see how the vulnerability leads to the threat.

Common mistakes: A weak password is the vulnerability, not the asset. The asset is the thing of value at risk, such as the student email account. The last part of a threat statement must state the harmful impact. Records that are safe mean no harm happened. It should say the records are leaked.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Writing a threat statement to a class →

This module's key terms are also in a printable crossword (Modules 782–809) and word search (Modules 743–809).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Which parts must a complete threat statement name?
The actor, the vulnerability, the asset and the impactOnly the name of the malware used
Matches
Hackers are dangerous and could harm the school.
↓
It is too vague. It does not name a specific actor, a vulnerability, an asset or a clear impact, and has no because to link cause and effect.
Applying
Meanings
Term
threat statement
Meaning
One sentence naming the actor, the vulnerability they use, the asset at risk and the impact, using because to link cause and effect.
Practice
A scammer could steal a student's email account because the password is weak, leading to private messages being leaked.
Testing
Gaps
the website has a weak login.
Check Answer
Spots
2Vulnerability: weak password
3Asset: weak password

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Thorny Devil' badge — Detail Master, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which parts must a complete threat statement name?
A. Only the name of the malware used
B. The actor, the vulnerability, the asset and the impact ✓
A threat statement packs four things into one sentence: who attacks, what weakness they use, what is at risk and what harm results.
2. Which sentence is a better threat statement?
A. Hackers are bad and could attack things.
B. A cybercriminal could guess the weak password on a student's email account, because it is short, and leak private messages. ✓
The better one names an actor (cybercriminal), a vulnerability (weak password), an asset (email account) and an impact (leaked messages).
3. In 'An insider could open the unlocked server room because the door has no lock, and steal customer records', what is the asset?
A. Customer records ✓
B. The insider
The asset is the thing of value at risk. The insider is the threat actor, and the missing lock is the vulnerability.
4. In 'A scammer could trick a user into sharing a password because the user cannot spot fake emails', what is the vulnerability?
A. The user cannot spot fake emails ✓
B. The scammer
The vulnerability is the weakness being used. The scammer is the actor.
5. What is the job of the word 'because' in a threat statement?
A. It links the cause (the vulnerability) to the effect (the attack succeeding) ✓
B. It lists the assets in alphabetical order
Using because shows why the attack is possible, so the reader can see how the vulnerability leads to the threat.

Match the Pairs

An outsider guesses the weak password on a student's email account and reads private messages. → A complete threat statement: it names the actor, the vulnerability, the asset and the impact in one sentence.
because → The linking word that joins the vulnerability to the impact so the statement shows cause and effect.
A threat statement must name the actor, the vulnerability, the asset and the impact. → A scammer could steal money from the school's bank account because a staff member reuses a weak password.
Because links the cause (vulnerability) to the effect (impact) in a threat statement. → Student records could be leaked because the database has default login details.
Hackers are dangerous and could harm the school. → It is too vague. It does not name a specific actor, a vulnerability, an asset or a clear impact, and has no because to link cause and effect.
An attacker could lock the school's files and demand payment. → The vulnerability is missing and there is no because. It does not explain why the attack is possible.

Key Term

threat statement
One sentence naming the actor, the vulnerability they use, the asset at risk and the impact, using because to link cause and effect.

Fill in the Blanks

1. A hacker can leak student records because the website has a weak login.
Hint: Type the linking word that joins the cause to the effect.
2. Actor: a hacker Vulnerability: no multi-factor login Asset: staff email accounts
Hint: Type the label for the person or group carrying out the attack.
3. Actor: a scammer Vulnerability: staff reuse passwords Asset: the school email system
Hint: Type the label for the weakness the attacker uses.
4. Actor: a ransomware gang Vulnerability: outdated server software Asset: patient health records
Hint: Type the label for the valuable thing that is at risk.
5. Actor: a hacker Vulnerability: unpatched web server Impact: customers lose their data
Hint: Type the label for the harm or result of the attack.

Spot the Error

Question 1
A Actor: a scammer
B Vulnerability: weak password
C Asset: weak password
D Impact: private emails leaked
Line C — A weak password is the vulnerability, not the asset. The asset is the thing of value at risk, such as the student email account.
Question 2
A An attacker can guess logins
B because the password is weak,
C so student records are safe.
Line C — The last part of a threat statement must state the harmful impact. Records that are safe mean no harm happened. It should say the records are leaked.
Question 3
A A thief can steal the laptop
B so it was left unlocked,
C so saved files are exposed
Line B — The cause (the vulnerability) must come after 'because'. 'so' introduces an effect, so it should read 'because it was left unlocked,'.
Question 4
A Actor: a careless insider
B Vulnerability: files deleted
C Asset: the shared class files
D Impact: work is lost for good
Line B — 'Files deleted' is an impact, not a weakness. The vulnerability is the gap the actor uses, such as having no backups.
Question 5
A Actor: a weak password
B Vulnerability: weak password
C Asset: online bank account
D Impact: money is stolen
Line A — The actor is the person or group who carries out the threat. A weak password is a vulnerability. The line should name an actor such as a cyber criminal.

Student with a class code? Join your class →