A threat risk assessment will best quantify the risk associated with malicious users in an organization, because it focuses on identifying and evaluating the potential sources of harm or damage to the organization's assets, such as data, systems, or networks. A malicious user is a person who intentionally and unauthorizedly accesses, modifies, destroys, or steals the organization's information or resources, for personal gain, revenge, espionage, or sabotage. A threat risk assessment can help the organization to estimate the likelihood and impact of malicious user attacks, based on factors such as the user's motivation, capability, opportunity, and access level. A threat risk assessment can also help the organization to determine the appropriate risk response strategies, such as prevention, detection, mitigation, or transfer, to reduce the risk exposure and impact of malicious user attacks. References = Risk IT Framework, ISACA, 2022, p. 141