1) The successful defeat of security, which could result in system penetration. 2) Violation of a system’s controls that exposes information assets or system components.