The potential for damage to be done maliciously or inadvertently by a legitimate user with privilleged access to systems, networks or data.