Which category classifies identified threats that do not have defenses in place and expose the application to exploits?

Unmitigated threats are specific, identified threats for which no security controls, countermeasures, or defenses have been implemented. In the context of threat modeling and risk assessment, after a threat is identified, it is analyzed to determine the risk it poses. If a decision is made not to apply a defense (e.g., due to cost, complexity, or risk acceptance), the threat remains unmitigated. This leaves the corresponding vulnerability in the application exposed and susceptible to exploitation by an attacker.

A. Fully mitigated threat: This describes a threat that has been effectively addressed by implementing one or more security controls, neutralizing the risk.

B. Threat profile: This is a broader concept that describes the types of attackers, their motivations, and the attack vectors relevant to an application, not the mitigation status of a single threat.

D. Partially mitigated threat: This refers to a threat where some defenses have been applied, but they are incomplete or do not fully address the associated risk.

---

1. National Institute of Standards and Technology (NIST). (2012). Special Publication (SP) 800-30 Revision 1, Guide for Conducting Risk Assessments.

Reference: Section 2.4, "Risk Response," page 21.

Explanation: This guide outlines risk response strategies. The "Risk Acceptance" strategy involves a decision to take no action to alter the risk. A threat associated with an accepted risk for which no controls are implemented is, by definition, an unmitigated threat.

2. Shostack, A. (2014). Threat Modeling: Designing for security. Wiley.

Reference: Chapter 16, "Managing and Documenting Threats," pages 315-317.

Explanation: This foundational text on threat modeling discusses the lifecycle of a threat, including tracking its mitigation status. Threats are often filed as bugs or work items and are considered open or "unmitigated" until a developer implements a fix or a conscious decision is made to accept the risk without a fix.

3. OWASP Foundation. (2021). Application Security Verification Standard (ASVS) 4.0.3.

Reference: Section V1.1, "Threat Modeling," Requirement 1.1.1.

Explanation: The standard requires that threat modeling results in a documented list of threats. For each threat, the organization must document either the "recommended controls" (mitigation) or the "acceptance of the risk." A threat where the risk is accepted without controls is an unmitigated threat.