Reassessing DREAD: A Critical Evaluation of Threat Prioritization in Modern Cybersecurity Risk Assessment

Abstract

This study provides a critical evaluation of the DREAD threat prioritisation model, identifying its fundamental limitations in modern cybersecurity environments and establishing the characteristics required for next-generation cybersecurity risk assessment models. A sequential mixed methodological design was employed, comprising a Systematic Literature Review (SLR) following the PRISMA 2020 framework, analytical evaluation, comparative model benchmarking against STRIDE, CVSS, and fuzzy-based approaches, and case-study-based simulation. The search was conducted across Scopus, Web of Science, IEEE Xplore, ScienceDirect, SpringerLink, ACM Digital Library, and Google Scholar. The SLR identified six principal limitations of the conventional DREAD model: subjectivity, scoring inconsistency, limited uncertainty representation, scalability constraints, static risk representation, and inadequate economic consideration. These limitations can produce inconsistent rankings, weak risk differentiation, reduced confidence in decisions, and less-informed resource allocation. Comparative evaluation demonstrates that while DREAD retains advantages in simplicity and interpretability, it performs poorly against requirements for uncertainty handling, adaptability, and economic decision support. The study establishes that next-generation models should be uncertainty-aware, context-sensitive, adaptive, multidimensional, cost-sensitive, explainable, scalable, consistent, and decision-oriented. This study provides a comprehensive, evidence-based critique of the DREAD model and establishes a rigorous requirements framework for next-generation cybersecurity risk assessment. The findings are directly applicable to researchers and practitioners seeking to develop or select contemporary cybersecurity risk prioritisation approaches.