potential cause of an unwanted incident, which can result in harm to a system or organization