Anything (e.g., object, substance, human) that is capable of acting against an asset in a manner that can result in harm. Scope Notes: A potential cause of an unwanted incident (ISO/IEC 13335)

ISACA Glossary [Information Systems Audit and Control Association]