Security incidents occur when the CIA triad gets compromised in any way. It could be an intentional attack perpetrated by a malicious actor, it could simply be the result of a poor configuration unintentionally compromising any of the three pillars, or even a natural disaster, as if a fire burnt down a data center to ashes.
As such, each main pillar from the CIA triad has one key threat associated with it. To understand how attackers approach these systems, cybersecurity professionals often turn to The DAD Triad—Disclosure, Alteration, and Denial—which mirrors the CIA triad but from an adversarial perspective.
The DAD Triad
Understanding the DAD triad helps defenders to think like an attacker, anticipating how a system might be targeted and which aspects are most vulnerable. By framing security incidents in this way, analysts can better prioritize defenses and prepare incident response strategies.