A security architect is analyzing components in a threat model for a new customer portal. After enumerating threats, the team needs a repeatable way to rank each identified threat so engineering can prioritize remediation. They decide to score each threat across dimensions such as potential damage, reproducibility, exploitability, affected users, and discoverability. Which threat modeling component is the team applying?