Currently, many methodological documents have been developed that regulate approaches to the development of models of threats to information security. for information systems that process information of a different nature. There are different methods of threat development and intruder model building proposed by information security regulators, depending on the direction of their activity. To support decision-making in the process of threat modeling, a databank of information security threats has been developed. However, there are a number of contradictions in existing approaches, while the methods for identifying threats and building a model of an intruder, in most cases, involve the involvement of experts to assess the factors and conditions for the emergence of threats. In the existing methods, there is no relationship between the violator of information security. and software vulnerabilities in information systems, which does not allow building an adequate threat model without the involvement of qualified experts. The purpose of this work is to determine the potential of an information security violator. depending on its capabilities and assessing the impact of this potential on the implementation of software vulnerabilities in information systems.