Exam PT0-003 topic 1 question 2 discussion

DREAD is a risk assessment model used to quantify and prioritize threats based on five factors: Damage, Reproducibility, Exploitability, Affected Users, and Discoverability. It helps testers systematically evaluate risks and determine the severity of potential security issues. On the other hand, PTES (Penetration Testing Execution Standard) is a comprehensive framework that outlines the entire penetration testing process, including pre-engagement interactions, intelligence gathering, threat modeling, exploitation, and reporting. While PTES includes threat modeling as one of its phases, DREAD is specifically designed for risk assessment, making it the preferred choice when creating a threat model.