Following an exhaustive on-site vulnerability evaluation, ICT evaluates the threat presented by different types of terrorist groups to the particular venue, building on input regarding the known characteristics of the terrorist groups active in the region in question, combined with the characteristics of each potential modus operandi.

The ICT venue-specific risk assessment model estimates the "attractiveness" of specific facilities to terrorists. In the absence of empirical data on threats, most planners and pundits fall back on "worst case" scenarios. However, this has often meant the over-allocation of resources to some of the least likely scenarios. Preparing for the "low risk / high consequence" attack is not the only (or even the best) response. Scarce resources can be better exploited if a way is found to classify threats according to likelihood, and not just according to the severity of consequences. Naturally, the assessment of which scenarios are most attractive must be made from the point of view of the terrorist. We need to be on the same wavelength as our enemies; we need to know our enemies from the inside out, and this requires sound intelligence. Our understanding of who the enemy is and what he is likely to do is part of what makes the ICT threat assessment an invaluable addition to our client's security strategy.

The ICT threat assessment method builds on considerable research into the characteristics of each organization. The same care is taken to examine the vulnerabilities of the venue in question, from the point of view of the potential terrorist - seeking weaknesses that might be exploited in the various scenarios under consideration.

The stages used in the threat assessment are: 

1. Organization-specific factors – We first determine which organizations present the greatest threat to the venue in question, based on its location and national affiliation, among other factors. These organizations are given a Risk Score, based on a set of pre-selected organization characteristics.
   
2. Venue-specific factors – We categorize scenarios according to the target selection strategies of these particular organizations. Care must be taken to examine the vulnerabilities of the venue in question from the point of view of the potential terrorist -seeking weaknesses that might be exploited to carry out an attack.
   
3. Numerical synthesis – We combine these two stages into a numerical analysis of what type of attack would appeal to which organization. This stage builds on considerable research into the characteristics of each organization. In this stage, we generate numerical ratings regarding the types of attacks that each organization might be inclined to carry out on the selected venue, based on our understanding of the organization's target-selection methods.

Threat assessments for private entities are administered by Counter-Terrorism Solutions, Ltd. (CTS).