Damage, Reproducibility, Exploitability, Affected Users, Discoverability
DREAD is a risk rating scheme that scores threats on five factors to help rank which ones to fix first. It was popularized alongside STRIDE at Microsoft, used after threats are identified to prioritize them during design and triage. Its subjectivity has drawn criticism and many teams have moved to other scoring methods, but the acronym remains a common interview and exam topic.