“Once the risk has been determined, the likelihood of an attack being successful can be assessed. In determining the susceptibility of an attack or “vulnerability to attack” it is assumed that the asset has been targeted, that the terrorists have the required weapon(s) and equipment, and that the attack will take place. The susceptibility then measures the probability that the attack would achieve its desired result given the constraints that are in place at the target, including physical constraints, operational constraints, and security measures. “There are a number of methods that can be used to calculate or estimate susceptibility. These range from simple ratings of security capabilities to complex, simulation-based evaluations of detailed attack scenarios. The most appropriate method will depend on the type of asset and the goals of the risk assessment. In general, however, an appropriate assessment of susceptibility would include an evaluation of physical features, security capabilities, and response capabilities that serve to prevent an attack from being successful. These activities can also be categorized as those that serve to deny, detect, delay, or defend against the attack, and are addressed by other capabilities in the TCL”. (DHS, TCL, 2007, p. 52)