When an instance of a threat occurs, it is referred to as being an incident. Incidents are unexpected or unwanted events that can threaten security, and have the ability to adversely effect the confidentiality, availability, or integrity of systems, projects, or businesses. Because a risk is the instance of a threat, it can occur from any number of the reasons discussed earlier in this chapter in the Risks and Threats section.

Certain threats may involve deliberate or malicious actions, so it is important that they are investigated and handled immediately after being identified. Companies may find their Web sites or networks hacked by outside parties, receive threats via e-mail, or fall victim to any number of cybercrimes. In other cases, an administrator may discover that people internal to the organization are committing crimes or violating policies. When certain incidents occur, the administrator not only needs to fix the immediate problem, but also needs to investigate the person behind it.