potential cause of an unwanted information security incident, which may result in harm